fixes

dunglas · dunglas · commit 92c8ef08ed0a · 2025-08-29T17:27:57.000+02:00
diff --git a/.editorconfig b/.editorconfig
@@ -5,50 +5,18 @@
 root = true
 
 [*]
-# Change these settings to your own preference
-indent_style = space
-indent_size = 4
-
-# We recommend you to keep these unchanged
-end_of_line = lf
 charset = utf-8
-trim_trailing_whitespace = true
 insert_final_newline = true
-
-[*.{js,html,ts,tsx}]
-indent_size = 2
-
-[*.json]
-indent_size = 2
-
-[*.md]
-trim_trailing_whitespace = false
-
-[*.sh]
-indent_style = tab
-
-[*.xml.dist]
+end_of_line = lf
 indent_style = space
 indent_size = 4
 
-[*.{yaml,yml}]
-trim_trailing_whitespace = false
-
-[.github/workflows/*.yml]
-indent_size = 2
-
-[.gitmodules]
+[**/{Dockerfile,Caddyfile,*.sh}]
 indent_style = tab
 
-[.php_cs.dist]
-indent_style = space
-indent_size = 4
-
-[composer.json]
-indent_size = 4
-
-[{compose}.{*.yaml,*.yml,yaml,yml}]
+[{compose.*yaml,.github/**/*.yaml}]
 indent_size = 2
 
-[Dockerfile,Caddyfile,Makefile]
-indent_style = tab
+[**.md]
+indent_size = unset
+indent_style = unset
diff --git a/.github/linters/zizmor.yaml b/.github/linters/zizmor.yaml
@@ -1,6 +1,6 @@
 ---
 rules:
-    unpinned-uses:
-        config:
-            policies:
-                "*": ref-pin
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -76,3 +76,6 @@ jobs:
         uses: super-linter/super-linter/slim@v8
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VALIDATE_CHECKOV: false
+          VALIDATE_TRIVY: false
+
diff --git a/Dockerfile b/Dockerfile
@@ -11,8 +11,6 @@ FROM dunglas/frankenphp:1-php8.4 AS frankenphp_upstream
 # Base FrankenPHP image
 FROM frankenphp_upstream AS frankenphp_base
 
-ARG USER=symfony
-
 WORKDIR /app
 
 VOLUME /app/var/
@@ -50,16 +48,6 @@ COPY --link frankenphp/conf.d/10-app.ini $PHP_INI_DIR/app.conf.d/
 COPY --link --chmod=755 frankenphp/docker-entrypoint.sh /usr/local/bin/docker-entrypoint
 COPY --link frankenphp/Caddyfile /etc/frankenphp/Caddyfile
 
-RUN \
-	# Use "adduser -D ${USER}" for alpine based distros
-	useradd ${USER}; \
-	# Add additional capability to bind to port 80 and 443
-	setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/frankenphp; \
-	# Give write access to /config/caddy and /data/caddy
-	chown -R ${USER}:${USER} /config/caddy /data/caddy
-
-USER ${USER}
-
 ENTRYPOINT ["docker-entrypoint"]
 
 HEALTHCHECK --start-period=60s CMD curl -f http://localhost:2019/metrics || exit 1
diff --git a/README.md b/README.md
@@ -15,16 +15,16 @@ with [FrankenPHP](https://frankenphp.dev) and [Caddy](https://caddyserver.com/)
 
 ## Features
 
--   Production, development and CI ready
--   Just 1 service by default
--   Blazing-fast performance thanks to [the worker mode of FrankenPHP](https://github.com/dunglas/frankenphp/blob/main/docs/worker.md) (automatically enabled in prod mode)
--   [Installation of extra Docker Compose services](docs/extra-services.md) with Symfony Flex
--   Automatic HTTPS (in dev and prod)
--   HTTP/3 and [Early Hints](https://symfony.com/blog/new-in-symfony-6-3-early-hints) support
--   Real-time messaging thanks to a built-in [Mercure hub](https://symfony.com/doc/current/mercure.html)
--   [Vulcain](https://vulcain.rocks) support
--   Native [XDebug](docs/xdebug.md) integration
--   Super-readable configuration
+- Production, development and CI ready
+- Just 1 service by default
+- Blazing-fast performance thanks to [the worker mode of FrankenPHP](https://github.com/dunglas/frankenphp/blob/main/docs/worker.md) (automatically enabled in prod mode)
+- [Installation of extra Docker Compose services](docs/extra-services.md) with Symfony Flex
+- Automatic HTTPS (in dev and prod)
+- HTTP/3 and [Early Hints](https://symfony.com/blog/new-in-symfony-6-3-early-hints) support
+- Real-time messaging thanks to a built-in [Mercure hub](https://symfony.com/doc/current/mercure.html)
+- [Vulcain](https://vulcain.rocks) support
+- Native [XDebug](docs/xdebug.md) integration
+- Super-readable configuration
 
 **Enjoy!**
 
diff --git a/compose.override.yaml b/compose.override.yaml
@@ -1,26 +1,26 @@
 ---
 # Development environment override
 services:
-    php:
-        build:
-            context: .
-            target: frankenphp_dev
-        volumes:
-            - ./:/app
-            - ./frankenphp/Caddyfile:/etc/frankenphp/Caddyfile:ro
-            - ./frankenphp/conf.d/20-app.dev.ini:/usr/local/etc/php/app.conf.d/20-app.dev.ini:ro
-            # If you develop on Mac or Windows you can remove the vendor/ directory
-            #  from the bind-mount for better performance by enabling the next line:
-            #- /app/vendor
-        environment:
-            FRANKENPHP_WORKER_CONFIG: watch
-            MERCURE_EXTRA_DIRECTIVES: demo
-            # See https://xdebug.org/docs/all_settings#mode
-            XDEBUG_MODE: "${XDEBUG_MODE:-off}"
-            APP_ENV: "${APP_ENV:-dev}"
-        extra_hosts:
-            # Ensure that host.docker.internal is correctly defined on Linux
-            - host.docker.internal:host-gateway
-        tty: true
+  php:
+    build:
+      context: .
+      target: frankenphp_dev
+    volumes:
+      - ./:/app
+      - ./frankenphp/Caddyfile:/etc/frankenphp/Caddyfile:ro
+      - ./frankenphp/conf.d/20-app.dev.ini:/usr/local/etc/php/app.conf.d/20-app.dev.ini:ro
+      # If you develop on Mac or Windows you can remove the vendor/ directory
+      #  from the bind-mount for better performance by enabling the next line:
+      #- /app/vendor
+    environment:
+      FRANKENPHP_WORKER_CONFIG: watch
+      MERCURE_EXTRA_DIRECTIVES: demo
+      # See https://xdebug.org/docs/all_settings#mode
+      XDEBUG_MODE: "${XDEBUG_MODE:-off}"
+      APP_ENV: "${APP_ENV:-dev}"
+    extra_hosts:
+      # Ensure that host.docker.internal is correctly defined on Linux
+      - host.docker.internal:host-gateway
+    tty: true
 ###> symfony/mercure-bundle ###
 ###< symfony/mercure-bundle ###
diff --git a/compose.prod.yaml b/compose.prod.yaml
@@ -1,11 +1,11 @@
 ---
 # Production environment override
 services:
-    php:
-        build:
-            context: .
-            target: frankenphp_prod
-        environment:
-            APP_SECRET: ${APP_SECRET}
-            MERCURE_PUBLISHER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET}
-            MERCURE_SUBSCRIBER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET}
+  php:
+    build:
+      context: .
+      target: frankenphp_prod
+    environment:
+      APP_SECRET: ${APP_SECRET}
+      MERCURE_PUBLISHER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET}
+      MERCURE_SUBSCRIBER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET}
diff --git a/compose.yaml b/compose.yaml
@@ -1,44 +1,44 @@
 ---
 services:
-    php:
-        image: ${IMAGES_PREFIX:-}app-php
-        restart: unless-stopped
-        environment:
-            SERVER_NAME: ${SERVER_NAME:-localhost}, php:80
-            MERCURE_PUBLISHER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
-            MERCURE_SUBSCRIBER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
-            # Run "composer require symfony/orm-pack" to install and configure Doctrine ORM
-            DATABASE_URL: postgresql://${POSTGRES_USER:-app}:${POSTGRES_PASSWORD:-!ChangeMe!}@database:5432/${POSTGRES_DB:-app}?serverVersion=${POSTGRES_VERSION:-15}&charset=${POSTGRES_CHARSET:-utf8}
-            # Run "composer require symfony/mercure-bundle" to install and configure the Mercure integration
-            MERCURE_URL: ${CADDY_MERCURE_URL:-http://php/.well-known/mercure}
-            MERCURE_PUBLIC_URL: ${CADDY_MERCURE_PUBLIC_URL:-https://${SERVER_NAME:-localhost}:${HTTPS_PORT:-443}/.well-known/mercure}
-            MERCURE_JWT_SECRET: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
-            # The two next lines can be removed after initial installation
-            SYMFONY_VERSION: ${SYMFONY_VERSION:-}
-            STABILITY: ${STABILITY:-stable}
-        volumes:
-            - caddy_data:/data
-            - caddy_config:/config
-        ports:
-            # HTTP
-            - target: 80
-              published: ${HTTP_PORT:-80}
-              protocol: tcp
-            # HTTPS
-            - target: 443
-              published: ${HTTPS_PORT:-443}
-              protocol: tcp
-            # HTTP/3
-            - target: 443
-              published: ${HTTP3_PORT:-443}
-              protocol: udp
+  php:
+    image: ${IMAGES_PREFIX:-}app-php
+    restart: unless-stopped
+    environment:
+      SERVER_NAME: ${SERVER_NAME:-localhost}, php:80
+      MERCURE_PUBLISHER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
+      MERCURE_SUBSCRIBER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
+      # Run "composer require symfony/orm-pack" to install and configure Doctrine ORM
+      DATABASE_URL: postgresql://${POSTGRES_USER:-app}:${POSTGRES_PASSWORD:-!ChangeMe!}@database:5432/${POSTGRES_DB:-app}?serverVersion=${POSTGRES_VERSION:-15}&charset=${POSTGRES_CHARSET:-utf8}
+      # Run "composer require symfony/mercure-bundle" to install and configure the Mercure integration
+      MERCURE_URL: ${CADDY_MERCURE_URL:-http://php/.well-known/mercure}
+      MERCURE_PUBLIC_URL: ${CADDY_MERCURE_PUBLIC_URL:-https://${SERVER_NAME:-localhost}:${HTTPS_PORT:-443}/.well-known/mercure}
+      MERCURE_JWT_SECRET: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
+      # The two next lines can be removed after initial installation
+      SYMFONY_VERSION: ${SYMFONY_VERSION:-}
+      STABILITY: ${STABILITY:-stable}
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+    ports:
+      # HTTP
+      - target: 80
+        published: ${HTTP_PORT:-80}
+        protocol: tcp
+      # HTTPS
+      - target: 443
+        published: ${HTTPS_PORT:-443}
+        protocol: tcp
+      # HTTP/3
+      - target: 443
+        published: ${HTTP3_PORT:-443}
+        protocol: udp
 
 # Mercure is installed as a Caddy module, prevent the Flex recipe from installing another service
 ###> symfony/mercure-bundle ###
 ###< symfony/mercure-bundle ###
 
 volumes:
-    caddy_data:
-    caddy_config:
+  caddy_data:
+  caddy_config:
 ###> symfony/mercure-bundle ###
 ###< symfony/mercure-bundle ###
diff --git a/docs/extra-services.md b/docs/extra-services.md
@@ -5,11 +5,11 @@ the recipe will automatically modify the `Dockerfile` and `compose.yaml` to fulf
 
 The currently supported packages are:
 
--   `symfony/orm-pack`: install a PostgreSQL service
--   `symfony/mercure-bundle`: use the Mercure.rocks module shipped with Caddy
--   `symfony/panther`: install chromium and these drivers
--   `symfony/mailer`: install a Mailpit service
--   `blackfireio/blackfire-symfony-meta`: install a Blackfire service
+- `symfony/orm-pack`: install a PostgreSQL service
+- `symfony/mercure-bundle`: use the Mercure.rocks module shipped with Caddy
+- `symfony/panther`: install chromium and these drivers
+- `symfony/mailer`: install a Mailpit service
+- `blackfireio/blackfire-symfony-meta`: install a Blackfire service
 
 > [!NOTE]
 > If a recipe modifies the Dockerfile, the container needs to be rebuilt.
diff --git a/docs/production.md b/docs/production.md
@@ -107,8 +107,8 @@ If you want to pass them to your containers, you can use the [`env_file` attribu
 # compose.prod.yml
 
 services:
-    php:
-        env_file:
-            - .env.prod.local
-        # ...
+  php:
+    env_file:
+      - .env.prod.local
+    # ...
 ```
diff --git a/docs/tls.md b/docs/tls.md
@@ -27,15 +27,15 @@ For instance, to use self-signed certificates created with [mkcert](https://gith
 3. Generate the certificates for your local host (example: "server-name.localhost"):
    `mkcert -cert-file frankenphp/certs/tls.pem -key-file frankenphp/certs/tls.key "server-name.localhost"`
 4. Add these lines to the `./compose.override.yaml` file about `CADDY_SERVER_EXTRA_DIRECTIVES` environment and volume for the `php` service :
-    ```diff
-    php:
-      environment:
-    +    CADDY_SERVER_EXTRA_DIRECTIVES: "tls /etc/caddy/certs/tls.pem /etc/caddy/certs/tls.key"
-        # ...
-      volumes:
-    +    - ./frankenphp/certs:/etc/caddy/certs:ro
-        # ...
-    ```
+   ```diff
+   php:
+     environment:
+   +    CADDY_SERVER_EXTRA_DIRECTIVES: "tls /etc/caddy/certs/tls.pem /etc/caddy/certs/tls.key"
+       # ...
+     volumes:
+   +    - ./frankenphp/certs:/etc/caddy/certs:ro
+       # ...
+   ```
 5. Restart your `php` service
 
 ## Disabling HTTPS for Local Development
diff --git a/docs/updating.md b/docs/updating.md
@@ -5,9 +5,9 @@ To import the changes made to the _Symfony Docker_ template into your project, w
 
 1. Run the script to synchronize your project with the latest version of the skeleton:
 
-    ```console
-    curl -sSL https://raw.githubusercontent.com/coopTilleuls/template-sync/main/template-sync.sh | sh -s -- https://github.com/dunglas/symfony-docker
-    ```
+   ```console
+   curl -sSL https://raw.githubusercontent.com/coopTilleuls/template-sync/main/template-sync.sh | sh -s -- https://github.com/dunglas/symfony-docker
+   ```
 
 2. Resolve conflicts, if any
 3. Run `git cherry-pick --continue`
diff --git a/docs/xdebug.md b/docs/xdebug.md
