Version 4.1.0

Image optimisation works again where a locale mismatch stopped it, PHP images pick up package security updates on every publishing build, PHP-FPM gains request draining for site releases, and the Zabbix templates gain certificate, domain, RAID and 1C checks. Yandex Cloud DNS users must re-enable the token refresh after upgrading (upgrade note 2).

Image optimisation

• A locale mismatch could stop every run before it processed a file: the file lists were sorted in the C locale, but comm ran in the cron locale and rejected them, and cron discarded the output. The script now runs in the C locale, and cron appends its output to logs/optimise-images.log.
• WebP images are no longer re-encoded. cwebp -q 100 re-encodes them lossily and often makes them larger. PNG, JPEG and GIF optimisation stays lossless.
• A file whose path and size match its database row counts as optimised even when its modification time changed, for example after a copy to a new host or the monthly hard-link deduplication.
• Progress is saved every 500 files, a lock stops the next weekly start while a long run is still going, and files changed in the last ten minutes wait for the next run.
• --originals-only leaves out upload/resize_cache (Bitrix thumbnails) and keeps their rows, for working through a backlog of originals first.

PHP

• PHP-FPM gains request-draining support for /web/prod and /web/dev, controlled by an external release script: config/php/deploy-gate.php is prepended to every php-fpm request (not to CLI or cron). Requests wait up to 15 seconds while the gate is locked, then continue without tracking. Without the lock files under logs/deploy-gate/ the gate is inactive.
• The PHP 8.3, 8.4 and 8.5 images run apt-get upgrade in a layer that is rebuilt on every publishing build, so PHP security releases from the package repositories land without waiting for a new base image. The image workflow can also be started by hand.

Disaster recovery and scripts

• Disaster recovery installs a docker.service drop-in that re-applies the Zabbix agent's ACL on the Docker socket whenever dockerd starts. dockerd recreates the socket on every restart, an unattended package upgrade included, which left Docker monitoring blind until the next reboot.
• Newly created zabbix, memcached and mysql service accounts use /usr/sbin/nologin instead of the useradd default /bin/sh.
• seo-reindex.sh exits non-zero when it attempted URLs and every submission was rejected, so cron-based monitoring sees the failure. Runs without quota, with an empty queue or with partial success still exit 0.
• renew-dev.sh excludes upload/acrit.export/ from the copy; existing dev copies of those files remain.
• The Yandex Cloud DNS token refresh is no longer scheduled: its line in config/cron/host.cron is commented out. Providers with a static API token, such as DigitalOcean, need nothing there.

Zabbix

• Certificate triggers lost in an earlier template reshuffle are back, and the expiry item is a float so negative days after expiry stay valid. Domain registration expiry is checked through the server-side ssl_cert_check.sh domain mode.
• A new template monitors Linux MD RAID state from /proc/mdstat.
• The tg-agent template alerts when the end-to-end MySQL tunnel check fails three times in a row or stops reporting for an hour, and the ads-cron failure alert names the cause from the last line of the run output. Both rely on the tg-agent side pushing those values.
• A new 1C template reads a daily check for changes made outside releases and a deferred-queue check from site endpoints. Its defaults point at favor-group.ru and need tokens, so import it only if you run those endpoints.

Upgrade notes

1. With your overlay's COMPOSE_PROFILES set: docker compose pull php php-cron && docker compose up -d php php-cron. nginx keeps the old php address until it reloads, so test and reload it afterwards (docker compose exec nginx nginx -t && docker compose exec nginx nginx -s reload).
2. If you renew certificates through Yandex Cloud DNS, uncomment the update-dns-token.sh line in config/cron/host.cron; otherwise the token expires within 12 hours and renewal fails.
3. On existing hosts, install the docker.service drop-in from zabbix_docker_acl_dropin in scripts/disaster-recovery.sh by hand and run systemctl daemon-reload.
4. Re-import the templates you already use (site monitoring, www redirect, tg-agent monitoring). The MD RAID template is new: import it and link it to the hosts with software RAID.
5. If earlier image optimisation runs failed, the first run after the upgrade may process a large backlog. On a large site start it by hand with --originals-only, then let the weekly run take the thumbnails.