feature(app): Implement Nginx stack.
#181
Conversation
|
Warning Rate limit exceeded@terabytesoftw has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 18 minutes and 50 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (5)
WalkthroughReplaces the external Codeception CI with a Docker Compose–based workflow and introduces a full Nginx/PHP-FPM container stack with Supervisor-managed services. Updates tests to target HTTPS, adjusts Codeception config, adds Dockerfiles, entrypoint/init scripts, Nginx and PHP configs, and refreshes README/CHANGELOG to reflect the new stack. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant GH as GitHub Actions
participant DC as docker-compose
participant C as Container (yii2-nginx)
participant CE as Codeception
GH->>GH: Checkout repo
GH->>GH: Install docker-compose
GH->>DC: up -d --build
GH-->>C: Wait for readiness
GH->>C: docker exec vendor/bin/codecept build
GH->>C: docker exec vendor/bin/codecept run
C-->>GH: Test results
sequenceDiagram
autonumber
participant Entrypoint as entrypoint.sh (PID 1)
participant Init as init.sh
participant Sup as supervisord
participant N as nginx
participant FPM as php-fpm
participant App as Yii2 App
Entrypoint->>Init: exec /usr/local/bin/init.sh
Init->>Init: Prepare dirs/permissions
alt Vendor missing
Init->>Init: Install Composer deps (prod/dev)
end
Init->>Sup: exec supervisord -c /etc/supervisor/supervisord.conf
Sup->>N: start nginx (daemon off)
Sup->>FPM: start php-fpm (nodaemonize)
N->>FPM: FastCGI /index.php
FPM->>App: Bootstrap Yii2
App-->>N: Response
N-->>Client: HTTPS response
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
…ginx` in build workflow.
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
README.md (1)
15-17: Fix broken Yii badge/link (looks like a 22.0.x typo).There’s no Yii “22.0.x” branch; this badge/link will 404 and mislead users.
- <a href="https://github.com/yiisoft/yii2/tree/22.0" target="_blank"> - <img src="https://img.shields.io/badge/22.0.x-0073AA.svg?style=for-the-badge&logo=yii&logoColor=white" alt="Yii 22.0.x"> - </a> + <!-- Removed invalid badge; Yii 2.x is already covered above -->
🧹 Nitpick comments (25)
CHANGELOG.md (1)
18-18: Entry looks good; keep.Consider linking the PR/commit for consistency with prior entries, but not required.
docker/supervisor/conf.d/php-fpm.conf (1)
2-13: Supervisor program for php-fpm is sane; minor hardening knobs optional.Startup/shutdown flags look correct. Optionally add bounded retries and graceful stop wait.
[program:php-fpm] command=/usr/local/sbin/php-fpm --nodaemonize autorestart=true autostart=true killasgroup=true priority=5 +startretries=3 +stopwaitsecs=20 stderr_logfile=/dev/stderr stderr_logfile_maxbytes=0 stdout_logfile=/dev/stdout stdout_logfile_maxbytes=0 stopasgroup=true stopsignal=QUITdocker/php/php.ini (1)
11-23: Nginx + FPM safety and pragmatic OPcache defaults.
- cgi.fix_pathinfo=0 is recommended with Nginx/FPM.
- JIT often brings little benefit for typical web apps; consider disabling by default to save memory.
# OPcache optimizations opcache.enable = 1 opcache.enable_cli = 1 opcache.interned_strings_buffer = 16 -opcache.jit = tracing -opcache.jit_buffer_size = 64M +; JIT is optional; disable by default for stability/lower RSS. Re-enable if you benchmark a benefit. +opcache.jit = 0 +opcache.jit_buffer_size = 0 opcache.max_accelerated_files = 20000 opcache.memory_consumption = 256 opcache.revalidate_freq = 2 opcache.validate_timestamps = 1 realpath_cache_size = 4096K realpath_cache_ttl = 120 + +; Nginx/FPM hardening +cgi.fix_pathinfo = 0README.md (4)
45-51: Fix incomplete sentence (“includes.” → “includes:”).-The Yii2 Web Application Basic template provides a complete foundation for building modern web applications. Unlike starting from scratch, this template includes. +The Yii2 Web Application Basic template provides a complete foundation for building modern web applications. Unlike starting from scratch, this template includes:
64-66: Create-project command is fine; optionally note why dev-nginx is used.A short note that minimum-stability is dev and the nginx stack lives on that branch can preempt questions.
70-76: Prefer ‘docker compose’ over legacy ‘docker-compose’.Both work; the plugin syntax is current.
-Start Nginx +Start Nginx @@ -docker-compose up -d +docker compose up -d
76-76: Consider adding a note about trusting the local TLS cert.Since HTTPS is on 8443 with a dev cert, mention how to trust it (mkcert or browser bypass) to avoid confusion.
tests/Acceptance.suite.yml (2)
9-11: Confirm runtime context for base URL (container vs host).Using https://localhost:443/ works only when Codeception runs inside the container. From the host, docker-compose exposes 8443 → 443, so tests would need https://localhost:8443/. If host execution is expected, add an env-specific override or document this explicitly.
10-10: Avoid TLS failures with self-signed certs (PhpBrowser).PhpBrowser will fail certificate verification against a self-signed localhost cert. If you’re not injecting a trusted CA, disable verification for local runs.
Apply within PhpBrowser config:
- url: https://localhost:443/ + url: https://localhost:443/ + curl: + CURLOPT_SSL_VERIFYPEER: false + CURLOPT_SSL_VERIFYHOST: 0docker/entrypoint.sh (1)
13-14: Remove unreachable lines after exec.After exec, the script never reaches the final echo. Drop dead code.
-# If we get here, everything went well -echo "=== Container ready ==="docker-compose.yml (3)
15-18: Ensure dev deps are installed for tests (YII_ENV).Defaulting YII_ENV to prod can skip dev deps (e.g., Codeception), breaking docker exec vendor/bin/codecept ... Consider defaulting to dev or override in CI.
- YII_ENV: "${YII_ENV:-prod}" + YII_ENV: "${YII_ENV:-dev}"Alternatively, set YII_ENV=dev in the CI job environment.
19-21: Healthcheck to replace fixed sleeps in CI.Add a healthcheck so CI waits on readiness deterministically.
ports: - '8080:80' - '8443:443' + healthcheck: + test: ['CMD-SHELL', 'curl -kfsS https://localhost/ || curl -fsS http://localhost/'] + interval: 5s + timeout: 3s + retries: 20 + start_period: 10s
11-12: Hardcoded container_name couples CI to a name.It’s workable, but ties docker exec to a fixed name. Prefer docker compose exec yii2-nginx ... or resolve the container ID: $(docker compose ps -q yii2-nginx).
docker/nginx/Dockerfile (4)
32-37: UID/GID remap can fail or break permissions; make it conditional.If UID/GID already exist, usermod/groupmod will fail; also better to honor USER_NAME/GROUP_NAME args.
Apply:
-# Apply the user/group IDs to www-data -RUN usermod -u ${USER_ID} www-data && groupmod -g ${GROUP_ID} www-data +# Apply the user/group IDs safely +RUN set -eux; \ + U="${USER_NAME}"; G="${GROUP_NAME}"; \ + if getent group "${GROUP_ID}" >/dev/null; then echo "GID ${GROUP_ID} exists"; else groupmod -g "${GROUP_ID}" "${G}"; fi; \ + if getent passwd "${USER_ID}" >/dev/null; then echo "UID ${USER_ID} exists"; else usermod -u "${USER_ID}" "${U}"; fi
6-7: Unused build args.USER_NAME and GROUP_NAME aren’t used; either wire them into usermod/groupmod (above) or drop the args.
43-45: Comment wording vs. intent (queue worker config).The comment says “uncommented” but the line is commented out. Given prior preference to keep yii2-queue optional, keep it commented and fix the wording.
Apply:
-# Copy queue worker config uncommented for use with yii2-queue +# Queue worker config is optional (uncomment if yii2-queue is installed)
59-60: Consider adding a HEALTHCHECK.Helps CI wait on readiness without arbitrary sleeps.
Example:
+HEALTHCHECK --interval=10s --timeout=3s --retries=10 CMD curl -fsS http://127.0.0.1/ || exit 1docker/nginx/nginx.conf (2)
6-10: Let Nginx select the best event method.Hard-coding use epoll reduces portability and offers little gain in containers.
Apply:
- use epoll; + # use platform default
26-29: TLS cipher suite is dated.Prefer modern intermediate profile; TLSv1.3 ciphers aren’t controlled by this directive anyway.
Apply:
- ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM'; - ssl_ecdh_curve X25519:P-256; - ssl_prefer_server_ciphers on; + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'; + ssl_ecdh_curve X25519:P-256; + ssl_prefer_server_ciphers off;docker/init.sh (2)
57-60: Don’t chown the entire /app tree.This is slow and can trample file ownership. Limit to writable dirs.
Apply:
- chown -R www-data:www-data /app && \ - chmod -R u+rwX,g+rwX /app + chown -R www-data:www-data /app/runtime /app/web/assets || true; \ + find /app -maxdepth 1 -type f -name "composer.*" -o -name "package*.json" | xargs -r chown www-data:www-data; \ + chmod -R u+rwX,g+rwX /app/runtime /app/web/assets
98-101: Add failure diagnostics if supervisord doesn’t start.A brief tail helps CI debug boot issues.
Apply:
-echo -e "${GREEN}Starting supervisor daemon...${NC}" +echo -e "${GREEN}Starting supervisor daemon...${NC}" +trap 'echo -e "${RED}✗ init.sh failed${NC}"; tail -n +1 /var/log/supervisor/* 2>/dev/null || true' ERRdocker/nginx/default.conf (2)
54-66: Improve PHP handling and symlink safety.Use fastcgi.conf and realpath_root; also tighten try_files.
Apply:
- location ~ \.php$ { - include fastcgi_params; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + location ~ \.php$ { + include fastcgi.conf; + fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name; fastcgi_param HTTPS on; fastcgi_pass 127.0.0.1:9000; - try_files $uri =404; + try_files $uri =404;
32-37: HSTS on localhost is unnecessary in dev.Optional: remove or shorten to avoid sticky HSTS in browsers.
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;.github/workflows/build.yml (2)
43-45: Typo: “Codeceptcion”.Fix the step name.
Apply:
- - name: Codeceptcion build. + - name: Codeception build.
46-47: Consider running tests with TTY and explicit env.Improves output and parity with local runs.
Apply:
- - name: Run codeception tests. - run: docker exec yii2-nginx vendor/bin/codecept run + - name: Run Codeception tests. + run: docker exec -e YII_ENV=prod -e YII_DEBUG=0 -t yii2-nginx vendor/bin/codecept run -vv
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (3)
composer.lockis excluded by!**/*.lockdocker/ssl/localhost-key.pemis excluded by!**/*.pemdocker/ssl/localhost.pemis excluded by!**/*.pem
📒 Files selected for processing (18)
.github/workflows/build.yml(1 hunks)CHANGELOG.md(1 hunks)README.md(3 hunks)codeception.yml(0 hunks)docker-compose.yml(1 hunks)docker/entrypoint.sh(1 hunks)docker/init.sh(1 hunks)docker/nginx/Dockerfile(1 hunks)docker/nginx/default.conf(1 hunks)docker/nginx/nginx.conf(1 hunks)docker/php/php.ini(1 hunks)docker/supervisor/conf.d/nginx.conf(1 hunks)docker/supervisor/conf.d/php-fpm.conf(1 hunks)docker/supervisor/conf.d/queue.conf(1 hunks)docker/supervisor/supervisord.conf(1 hunks)tests/Acceptance.suite.yml(1 hunks)tests/_envs/dockerized.yml(0 hunks)tests/_envs/php-builtin.yml(0 hunks)
💤 Files with no reviewable changes (3)
- codeception.yml
- tests/_envs/php-builtin.yml
- tests/_envs/dockerized.yml
🧰 Additional context used
🧠 Learnings (10)
📚 Learning: 2025-07-10T13:59:10.839Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#102
File: docker/apache/Dockerfile:0-0
Timestamp: 2025-07-10T13:59:10.839Z
Learning: In docker/apache/Dockerfile, the queue.conf copy command is intentionally commented out because yii2-queue is optional. Users should uncomment the line `COPY docker/apache/supervisord/conf.d/queue.conf /etc/supervisor/conf.d/queue.conf` only if they install yii2-queue.
Applied to files:
docker/supervisor/conf.d/queue.confdocker/nginx/Dockerfile
📚 Learning: 2025-08-31T15:34:39.060Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#142
File: README.md:0-0
Timestamp: 2025-08-31T15:34:39.060Z
Learning: In yii2-extensions/app-basic project, the dev-road-runner branch is treated as the main configuration branch with no stable releases available. Static badges pointing to dev branches are intentionally used to direct users to the development version.
Applied to files:
README.md
📚 Learning: 2025-09-02T15:21:03.184Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#170
File: docker/apache/Dockerfile:27-35
Timestamp: 2025-09-02T15:21:03.184Z
Learning: In yii2-extensions/app-basic, this is a demo template where simplicity and ease of use are prioritized over production-grade security hardening. Security trade-offs like using curl | bash for Node.js installation are acceptable for demonstration purposes.
Applied to files:
README.md
📚 Learning: 2025-09-02T09:36:57.071Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#166
File: .github/workflows/build.yml:31-33
Timestamp: 2025-09-02T09:36:57.071Z
Learning: The yii2-extensions/app-basic repository is a demo template that includes pre-generated SSL certificates using mkcert, designed to provide a "one-click" transparent demo experience for users.
Applied to files:
README.md
📚 Learning: 2025-09-02T15:23:37.606Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#170
File: docker/init.sh:26-49
Timestamp: 2025-09-02T15:23:37.606Z
Learning: The yii2-extensions/app-basic repository is a demo template where practical functionality and ease of setup take priority over security hardening measures.
Applied to files:
README.md
📚 Learning: 2025-09-02T15:20:17.088Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#170
File: config/web/modules.php:14-15
Timestamp: 2025-09-02T15:20:17.088Z
Learning: In the yii2-extensions/app-basic repository, this is a demo template where permissive development settings like allowedIPs => ['*'] for debug and gii modules are acceptable for ease of setup and demonstration purposes.
Applied to files:
README.md
📚 Learning: 2025-09-02T15:23:30.902Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#170
File: docker/init.sh:1-1
Timestamp: 2025-09-02T15:23:30.902Z
Learning: In yii2-extensions/app-basic repository, the maintainer terabytesoftw prefers to keep demo template scripts simple without additional bash safety measures like strict mode (set -Eeuo pipefail), as they consider different quality standards appropriate for demo/template code versus production code.
Applied to files:
README.md
📚 Learning: 2025-08-31T15:29:19.131Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#142
File: docs/installation.md:21-23
Timestamp: 2025-08-31T15:29:19.131Z
Learning: In yii2-extensions/app-basic project, the composer.json file has "minimum-stability": "dev" configured, which allows Composer to install dev versions automatically without requiring --stability=dev flag in create-project commands.
Applied to files:
README.md
📚 Learning: 2025-08-25T21:03:02.960Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#128
File: docs/installation.md:7-7
Timestamp: 2025-08-25T21:03:02.960Z
Learning: In yii2-extensions/app-basic project, npm is listed as a system requirement in docs/installation.md because the composer.json file contains scripts that depend on npm commands for frontend asset management and build processes.
Applied to files:
README.md
📚 Learning: 2025-08-25T21:03:02.960Z
Learnt from: terabytesoftw
PR: yii2-extensions/app-basic#128
File: docs/installation.md:7-7
Timestamp: 2025-08-25T21:03:02.960Z
Learning: The yii2-extensions/app-basic project uses php-forge/foxy Composer plugin which automatically runs npm install during composer install/update, making npm a required system dependency rather than optional. The documentation correctly lists npm in system requirements due to this integration.
Applied to files:
README.md
🔇 Additional comments (6)
README.md (2)
19-23: Badges updated to nginx branch — looks correct.
139-141: Codecov/StyleCI badges point to nginx — looks consistent.docker/supervisor/supervisord.conf (1)
2-7: Log handling is fine; rotation is disabled.Logs go to stdout with no rotation. Acceptable for containers; just be aware of noisy output.
docker/entrypoint.sh (1)
7-11: Idempotent init handoff looks good.Strict mode + exec to init.sh is correct for PID 1.
docker/supervisor/conf.d/nginx.conf (1)
1-12: Supervisor program config for Nginx looks solid.Foreground mode, proper stop signal, stdout/stderr wiring are correct.
docker/nginx/nginx.conf (1)
55-57: Ensure/etc/nginx/sites-enabledexists in the base image
The automated check couldn’t run (docker not available in this environment). Manually verify by inspecting theyiisoftware/yii2-php:8.4-fpm-nginximage (e.g.,docker run --rm --entrypoint ls yiisoftware/yii2-php:8.4-fpm-nginx -ld /etc/nginx/sites-enabled). If the directory is missing, either create it in your Dockerfile (mkdir -p /etc/nginx/sites-enabled) or remove the include to avoid build failures.
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
1 participant
Summary by CodeRabbit