Unit tests standard

.docker/Dockerfile

@@ -0,0 +1,60 @@
+# syntax=docker/dockerfile:1
+
+FROM pimcore/pimcore:php8.4-v4 AS base
+RUN set -eux; \
+    apt-get update -y; \
+    apt-get install -y --no-install-recommends autoconf make g++ unixodbc-dev cron procps iputils-ping vim supervisor netcat-traditional default-mysql-client; \
+    rm -rf /var/lib/apt/lists/*; \
+    usermod -u 1000 www-data; \
+    groupmod -g 1000 www-data;
+# We copy in the composer files and download dependencies, then in a separate set of statements below copy in the full
+# source directory and run a full composer install. This will take advantage of Docker-build caching when the composer
+# dependencies do not change.
+COPY --chown=www-data:www-data /composer.* /var/www/html
+COPY /.docker/composer-install-dependencies.sh /composer-install-dependencies.sh
+RUN /composer-install-dependencies.sh
+COPY /.docker/secrets-to-env-vars.sh /etc/profile.d/secrets-to-env-vars.sh
+COPY --chown=www-data:www-data / /var/www/html
+RUN --mount=type=secret,id=kernel-secret,uid=1000 \
+    # These three secrets are deliberately mounted as env vars rather than files as required by Pimcore
+    --mount=type=secret,id=pimcore-product-key,env=PIMCORE_PRODUCT_KEY,uid=1000 \
+    --mount=type=secret,id=pimcore-instance-identifier,env=PIMCORE_INSTANCE_IDENTIFIER,uid=1000 \
+    --mount=type=secret,id=pimcore-encryption-secret,env=PIMCORE_ENCRYPTION_SECRET,uid=1000 \
+        set -eux; \
+        cd /var/www/html; \
+        runuser -u www-data -- php /usr/local/bin/composer install; \
+        runuser -u www-data -- /var/www/html/bin/console pimcore:build:classes; \
+        runuser -u www-data -- /var/www/html/bin/console cache:warmup
+
+FROM base AS init
+COPY ./.docker/init/install-bundles.sh /install-bundles.sh
+COPY /.docker/init/init.sh /init.sh
+CMD [ "/init.sh" ]
+
+FROM base AS php
+RUN set -eux; \
+    apt-get update -y; \
+    apt-get install -y --no-install-recommends nginx wget; \
+    rm -rf /var/lib/apt/lists/*;
+COPY /.docker/php/php.ini /usr/local/etc/php/conf.d/docker-pimcore-php.ini
+COPY /.docker/php/nginx.conf /etc/nginx/sites-available/default
+COPY /.docker/php/supervisord.conf /etc/supervisor/supervisord.conf
+COPY ./.docker/php/start-php.sh /start-php.sh
+CMD [ "/start-php.sh" ]
+
+FROM base AS supervisord
+COPY --from=pimcore/pimcore:php8.4-supervisord-v4 /var/run /var/run
+COPY --from=pimcore/pimcore:php8.4-supervisord-v4 /usr/sbin/cron /usr/sbin/cron
+COPY --from=pimcore/pimcore:php8.4-supervisord-v4 /etc/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
+COPY /.docker/supervisord/supervisord.conf /etc/supervisor/conf.d/pimcore.conf
+COPY ./.docker/supervisord/start-supervisord.sh /start-supervisord.sh
+CMD [ "/start-supervisord.sh" ]
+
+FROM base AS php-debug
+COPY --from=pimcore/pimcore:php8.4-debug-v4 /usr/local/bin/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN pecl install xdebug; \
+    docker-php-ext-enable xdebug;
+ENV PHP_IDE_CONFIG=serverName=localhost
+COPY /.docker/php-debug/xdebug.conf /usr/local/etc/php/conf.d/docker-php-ext-xdebug.ini
+COPY /.docker/php-debug/start-php-debug.sh /start-php-debug.sh
+CMD [ "/start-php-debug.sh" ]

.docker/composer-install-dependencies.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+echo Configuring Composer...
+mkdir -p /var/www/.cache/composer && chown -R www-data:www-data /var/www/.cache/composer
+mkdir -p /var/www/.config/composer && chown -R www-data:www-data /var/www/.config/composer
+echo Installing Composer packages...
+cd /var/www/html && runuser -u www-data -- php -d memory_limit=-1 -d xdebug.remote_enable=0 /usr/local/bin/composer install --prefer-dist --no-scripts

.docker/init/init.local.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -e
+
+source /etc/profile.d/secrets-to-env-vars.sh
+
+/composer-install-dependencies.sh
+
+if [ "$(mysql -h "$DATABASE_HOST" -u "$DATABASE_USER" -p"$DATABASE_PASSWORD" \
+      -sse "select count(*) from information_schema.tables where table_schema='pimcore' and table_name='assets';")" -ne 0 ]
+then
+    # Only run cache clear if the database is seeded. If it is not, trying to clear the cache will cause errors.
+    # init.sh will handle seeding it
+    runuser -u www-data -- bin/console cache:clear
+fi
+
+/init.sh

.docker/init/init.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -e
+
+source /etc/profile.d/secrets-to-env-vars.sh
+
+if [ "$(mysql -h "$DATABASE_HOST" -u "$DATABASE_USER" -p"$DATABASE_PASSWORD" \
+      -sse "select count(*) from information_schema.tables where table_schema='pimcore' and table_name='assets';")" -eq 0 ] \
+   && [ "$PIMCORE_INSTALL" = "true" ]
+then
+  echo "Database is empty and PIMCORE_INSTALL is set to true, so calling pimcore-install..."
+  PIMCORE_INSTALL_ENCRYPTION_SECRET=$PIMCORE_ENCRYPTION_SECRET \
+  PIMCORE_INSTALL_INSTANCE_IDENTIFIER=$PIMCORE_INSTANCE_IDENTIFIER \
+  PIMCORE_INSTALL_PRODUCT_KEY=$PIMCORE_PRODUCT_KEY \
+    runuser -u www-data -- vendor/bin/pimcore-install --skip-database-config --no-interaction
+fi
+
+echo Installing bundles...
+/install-bundles.sh
+
+echo Running migration...
+runuser -u www-data -- /var/www/html/bin/console doctrine:migrations:migrate -n
+
+echo Rebuilding classes...
+runuser -u www-data -- /var/www/html/bin/console pimcore:deployment:classes-rebuild -c -d -n --force
+
+echo Creating folders...
+runuser -u www-data -- /var/www/html/bin/console torq:folder-creator
+
+echo Generating roles...
+runuser -u www-data -- /var/www/html/bin/console torq:generate-roles
+
+echo Clearing Pimcore cache...
+runuser -u www-data -- /var/www/html/bin/console pimcore:cache:clear
+
+echo Generating quantity values...
+runuser -u www-data -- /var/www/html/bin/console definition:import:units config/quantityvalues.json --override

.docker/init/install-bundles.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+BUNDLES=$(
+    bin/console pimcore:bundle:list --json | \
+    php -r '
+      $bundles = json_decode(stream_get_contents(STDIN), true);
+      $toInstall = [];
+      foreach($bundles as $b) {
+        if ($b["Enabled"] == true && 
+            $b["Installed"] == false && 
+            $b["Installable"] == true) {
+          $toInstall[] = $b["Bundle"];
+        }
+      }
+      echo implode(" ", $toInstall);
+    '
+)
+
+if [ -z "${BUNDLES}" ]; then
+    echo "No bundles to install"
+else
+    for BUNDLE in ${BUNDLES}; do
+       echo "Installing bundle: ${BUNDLE}"
+       runuser -u www-data -- /var/www/html/bin/console pimcore:bundle:install "${BUNDLE}" --no-interaction --no-cache-clear
+    done
+
+    echo "Manually clearing cache..."
+    runuser -u www-data -- /var/www/html/bin/console cache:clear --no-interaction
+fi

.docker/php-debug/nginx-debug.conf

@@ -0,0 +1,184 @@
+
+# mime types are already covered in nginx.conf
+#include mime.types;
+
+upstream php-pimcore10 {
+    server php:9000;
+}
+
+upstream php-pimcore10-debug {
+    server php-debug:9000;
+}
+
+map $args $static_page_root {
+    default                                 /var/tmp/pages;
+    "~*(^|&)pimcore_editmode=true(&|$)"     /var/nonexistent;
+    "~*(^|&)pimcore_preview=true(&|$)"      /var/nonexistent;
+    "~*(^|&)pimcore_version=[^&]+(&|$)"     /var/nonexistent;
+}
+
+map $uri $static_page_uri {
+    default                                 $uri;
+    "/"                                     /%home;
+}
+
+server {
+    listen [::]:80 default_server;
+    listen 80 default_server;
+
+    #server_name pimcore.localhost;
+
+    root /var/www/html/public;
+    index index.php;
+
+    # Filesize depending on your data
+    client_max_body_size 100m;
+
+    # It is recommended to seclude logs per virtual host
+    #access_log  /var/log/access.log;
+    #error_log   /var/log/error.log error;
+
+    # Protected Assets
+    #
+    ### 1. Option - Restricting access to certain assets completely
+    #
+    # location ~ ^/protected/.* {
+    #   return 403;
+    # }
+    # location ~ ^/var/.*/protected(.*) {
+    #   return 403;
+    # }
+    #
+    # location ~ ^/cache-buster\-[\d]+/protected(.*) {
+    #   return 403;
+    # }
+    #
+    ### 2. Option - Checking permissions before delivery
+    #
+    # rewrite ^(/protected/.*) /index.php$is_args$args last;
+    #
+    # rewrite ^(/cache-buster-(?:\d+)/protected(?:.*)) /index.php$is_args$args last;
+    #
+    # location ~ ^/var/.*/protected(.*) {
+    #   return 403;
+    # }
+    #
+    # location ~ ^/cache-buster\-[\d]+/protected(.*) {
+    #   return 403;
+    # }
+
+    # Pimcore Head-Link Cache-Busting
+    rewrite ^/cache-buster-(?:\d+)/(.*) /$1 last;
+
+    # Stay secure
+    #
+    # a) don't allow PHP in folders allowing file uploads
+    location ~* /var/assets/.*\.php(/|$) {
+        return 404;
+    }
+
+    # b) Prevent clients from accessing hidden files (starting with a dot)
+    # Access to `/.well-known/` is allowed.
+    # https://www.mnot.net/blog/2010/04/07/well-known
+    # https://tools.ietf.org/html/rfc5785
+    location ~* /\.(?!well-known/) {
+        deny all;
+        log_not_found off;
+        access_log off;
+    }
+
+    # c) Prevent clients from accessing to backup/config/source files
+    location ~* (?:\.(?:bak|conf(ig)?|dist|fla|in[ci]|log|psd|sh|sql|sw[op])|~)$ {
+        deny all;
+    }
+
+    # Some Admin Modules need this:
+    # Server Info, Opcache
+    location ~* ^/admin/external {
+        rewrite .* /index.php$is_args$args last;
+    }
+
+    # Thumbnails
+    location ~* .*/(image|video)-thumb__\d+__.* {
+        try_files /var/tmp/thumbnails$uri /index.php;
+        expires 2w;
+        access_log off;
+        add_header Cache-Control "public";
+    }
+
+    # Assets
+    # Still use a whitelist approach to prevent each and every missing asset to go through the PHP Engine.
+    location ~* ^(?!/admin|/asset/webdav|/studio/api)(.+?)\.((?:css|js)(?:\.map)?|jpe?g|gif|png|svgz?|eps|exe|gz|json|zip|mp\d|m4a|ogg|ogv|webp|webm|pdf|csv|docx?|xlsx?|pptx?)$ {
+        try_files /var/assets$uri $uri =404;
+        expires 2w;
+        access_log off;
+        log_not_found off;
+        add_header Cache-Control "public";
+    }
+
+    location / {
+        error_page 404 /meta/404;
+        try_files $static_page_root$static_page_uri.html $uri /index.php$is_args$args;
+    }
+
+    # Use this location when the installer has to be run
+    # location ~ /(index|install)\.php(/|$) {
+    #
+    # Use this after initial install is done:
+    location ~ ^/index\.php(/|$) {
+        send_timeout 1800;
+        fastcgi_read_timeout 1800;
+        # regex to split $uri to $fastcgi_script_name and $fastcgi_path_info
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        # Check that the PHP script exists before passing it
+        #try_files $fastcgi_script_name =404;
+        # include fastcgi.conf if needed
+        include fastcgi_params;
+        # Bypass the fact that try_files resets $fastcgi_path_info
+        # see: http://trac.nginx.org/nginx/ticket/321
+        set $path_info $fastcgi_path_info;
+        fastcgi_param PATH_INFO $path_info;
+
+        # Activate these, if using Symlinks and opcache
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+        fastcgi_param DOCUMENT_ROOT $realpath_root;
+
+        # Mitigate https://httpoxy.org/ vulnerabilities
+        fastcgi_param HTTP_PROXY "";
+
+        # If Xdebug session is requested, pass it to the Xdebug enabled container
+        if ($http_cookie ~* "XDEBUG_SESSION") {
+            fastcgi_pass php-pimcore10-debug;
+        }
+
+        fastcgi_pass php-pimcore10;
+        # Prevents URIs that include the front controller. This will 404:
+        # http://domain.tld/index.php/some-path
+        # Remove the internal directive to allow URIs like this
+        internal;
+    }
+
+    # PHP-FPM Status and Ping
+    location /fpm- {
+        access_log off;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        location /fpm-status {
+            allow 127.0.0.1;
+            # add additional IP's or Ranges
+            deny all;
+            fastcgi_pass php-pimcore10;
+        }
+        location /fpm-ping {
+            fastcgi_pass php-pimcore10;
+        }
+    }
+    # nginx Status
+    # see: https://nginx.org/en/docs/http/ngx_http_stub_status_module.html
+    location /nginx-status {
+        allow 127.0.0.1;
+        deny all;
+        access_log off;
+        stub_status;
+    }
+}

.docker/php-debug/start-php-debug.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+source /etc/profile.d/secrets-to-env-vars.sh
+exec "/usr/local/bin/entrypoint.sh" php-fpm

.docker/php-debug/xdebug.conf

@@ -0,0 +1,13 @@
+zend_extension=xdebug
+
+[xdebug]
+xdebug.mode=debug,develop,profile
+xdebug.output_dir = /var/www/html/var/log/xdebug.log
+xdebug.client_host=host.docker.internal
+xdebug.client_port=9003
+xdebug.cli_color=1
+xdebug.start_with_request=trigger
+xdebug.log_level=3
+xdebug.log=/var/www/html/var/log/xdebug.log
+xdebug.discover_client_host=1
+xdebug.max_nesting_level=256