Merge pull request #346 from itk-dev/feature/d-10

Drupal 10

Author: rimi-itk

.docker/vhost.conf

@@ -33,8 +33,7 @@ server {
     }
 
     # Block access to "hidden" files and directories whose names begin with a
-    # period. This includes directories used by version control systems such
-    # as Subversion or Git to store control files.
+    # period.
     location ~ (^|/)\. {
         return 403;
     }
@@ -44,7 +43,7 @@ server {
     }
 
     location @rewrite {
-        rewrite ^/(.*)$ /index.php?q=$1;
+        rewrite ^ /index.php;
     }
 
     # Don't allow direct access to PHP files in the vendor directory.
@@ -53,13 +52,23 @@ server {
         return 404;
     }
 
+    # Protect files and directories from prying eyes.
+    location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|.tar|.gz|.bz2|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
+        deny all;
+        return 404;
+    }
+
     location ~ '\.php$|^/update.php' {
+        include fastcgi_params;
+
         fastcgi_buffers 16 32k;
         fastcgi_buffer_size 64k;
         fastcgi_busy_buffers_size 64k;
 
         fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
-        include fastcgi_params;
+
+        # Ensure the php file exists. Mitigates CVE-2019-11043
+        try_files $fastcgi_script_name =404;
 
         fastcgi_param HTTP_PROXY "";
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
@@ -70,30 +79,12 @@ server {
         fastcgi_pass phpfpm:9000;
     }
 
-    location ~ ^/sites/.*/files/styles/ {
-        try_files $uri @rewrite;
-    }
-
-    # Handle private files through Drupal. Private file's path can come
-    # with a language prefix.
-    location ~ ^(/[a-z\-]+)?/system/files/ {
-        try_files $uri /index.php?$query_string;
-    }
-
-    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
-        try_files $uri @rewrite;
-        expires max;
-        log_not_found off;
-    }
-
     # Enforce clean URLs
-    # Removes index.php from urls like:
-    # www.example.com/index.php/my-page --> www.example.com/my-page
     #
+    # Removes index.php from urls like www.example.com/index.php/my-page --> www.example.com/my-page
     # Could be done with 301 for permanent or other redirect codes.
-    absolute_redirect off;
     if ($request_uri ~* "^(.*/)index\.php/(.*)") {
-        return 301 /$2;
+        return 307 $1$2;
     }
 
     error_log /dev/stderr;

.github/workflows/docker-image.yaml

@@ -11,7 +11,7 @@ jobs:
     - name: Setup PHP, with composer and extensions
       uses: shivammathur/setup-php@v2
       with:
-        php-version: 7.4
+        php-version: 8.2
         extensions: dom, zip
         coverage: none
         tools: composer:v2

.github/workflows/pr.yaml

@@ -9,7 +9,7 @@ jobs:
       - name: Setup PHP, with composer and extensions
         uses: shivammathur/setup-php@v2
         with:
-          php-version: 8.1
+          php-version: 8.2
           extensions: ctype, dom, iconv, json, zip, gd, soap
           coverage: none
           tools: composer:v2
@@ -35,7 +35,7 @@ jobs:
       - name: Setup PHP, with composer and extensions
         uses: shivammathur/setup-php@v2
         with:
-          php-version: 8.1
+          php-version: 8.2
           extensions: ctype, dom, iconv, json, zip, gd, soap
           coverage: none
           tools: composer:v2
@@ -51,10 +51,7 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
       - name: Install Dependencies
         run: |
-          # Using `--no-scripts` breaks something with mglaman/drupal-check.
           composer install --no-interaction --no-progress
-          # @see https://github.com/Dealerdirect/phpcodesniffer-composer-installer#calling-the-plugin-directly
-          composer run-script install-codestandards
       - name: PHPCS
         run: |
           composer coding-standards-check
@@ -98,7 +95,7 @@ jobs:
       - name: Setup PHP, with composer and extensions
         uses: shivammathur/setup-php@v2
         with:
-          php-version: 8.1
+          php-version: 8.2
           extensions: ctype, dom, iconv, json, zip, gd, soap
           coverage: none
           tools: composer:v2
@@ -168,7 +165,7 @@ jobs:
       - name: Setup PHP, with composer and extensions
         uses: shivammathur/setup-php@v2
         with:
-          php-version: 8.1
+          php-version: 8.2
           extensions: ctype, dom, iconv, json, zip, gd, soap
           coverage: none
           tools: composer:v2

.gitignore

@@ -129,6 +129,9 @@
 /web/sites/*/*settings*.php
 /web/sites/*/*services*.yml
 
+# We want all custom site settings in settings.local.php, so we don't ignore settings.php.
+!/web/sites/*/settings.php
+
 # Ignore paths that may contain user-generated content
 /web/sites/*/files
 /web/sites/*/public
@@ -183,10 +186,6 @@
 
 # ------------------------------------------------------------------------------
 
-# We want all custom site settings in settings.local.php
-/web/sites/*/settings.local.php
-!/web/sites/*/settings.php
-
 # Ignore PhpStorm
 .idea
 
@@ -199,4 +198,6 @@ node_modules/
 yarn-error.log
 
 # Ignore DS store
-.DS_Store
+.DS_Store
+
+.env*.local

README.md

@@ -10,6 +10,34 @@
 OS2loop is a question-answering system built on Drupal 9. See [os2.eu/produkt/os2loop](https://os2.eu/produkt/os2loop)
 (in Danish) for more information.
 
+## Upgrading to Drupal 10
+
+Upgrading to [Drupal 10](https://www.drupal.org/about/10) is a two-step process:
+first the site must be prepared for the upgrade ([tag:
+d-10-prepare](/releases/tag/d-10-prepare)) and then the actual upgrade must be
+performed.
+
+```sh
+# Backup the database
+
+# Prepare for the upgrade
+git checkout d-10-prepare
+composer install --no-dev --optimize-autoloader
+vendor/bin/drush --yes pm:uninstall samlauth
+vendor/bin/drush --yes deploy
+vendor/bin/drush --yes locale:update
+vendor/bin/drush --yes cache:rebuild
+
+# Check that site still works
+
+# Upgrade to Drupal 10
+git checkout «release tag»
+composer install --no-dev --optimize-autoloader
+vendor/bin/drush --yes deploy
+vendor/bin/drush --yes locale:update
+vendor/bin/drush --yes cache:rebuild
+```
+
 ## Installation
 
 ### Production
@@ -54,14 +82,15 @@ modules.
 
 See [docs/development](docs/development/README.md) for details on development.
 
+[Install Task](https://taskfile.dev/installation/) and run
+
 ```sh
-docker compose up --detach
-docker compose exec phpfpm composer install
-docker compose exec phpfpm vendor/bin/drush --yes site:install os2loop --existing-config
+task dev:up
+task dev:install-site --yes
 # Get the site url
 echo "http://$(docker compose port nginx 8080)"
 # Get admin sign in url
-docker compose exec phpfpm vendor/bin/drush --yes --uri="http://$(docker compose port nginx 8080)" user:login
+task dev:drush -- --yes --uri="http://$(docker compose port nginx 8080)" user:login
 ```
 
 ### Modules
@@ -100,11 +129,11 @@ docker compose exec phpfpm vendor/bin/drush --yes pm:enable entity_reference_int
 ## Updates
 
 ```sh
-composer install --no-dev --optimize-autoloader
-vendor/bin/drush --yes updatedb
-vendor/bin/drush --yes config:import
-vendor/bin/drush --yes locale:update
-vendor/bin/drush --yes cache:rebuild
+docker compose exec phpfpm composer install --no-dev --optimize-autoloader
+docker compose exec phpfpm vendor/bin/drush --yes updatedb
+docker compose exec phpfpm vendor/bin/drush --yes config:import
+docker compose exec phpfpm vendor/bin/drush --yes locale:update
+docker compose exec phpfpm vendor/bin/drush --yes cache:rebuild
 ```
 
 ## Translations
@@ -132,14 +161,14 @@ for further details.
 ## Coding standards
 
 ```sh
-composer coding-standards-check
-composer coding-standards-apply
+docker compose exec phpfpm composer coding-standards-check
+docker compose exec phpfpm composer coding-standards-apply
 ```
 
 ```sh
-docker run --rm --volume ${PWD}:/app --workdir /app node:16 yarn install
-docker run --rm --volume ${PWD}:/app --workdir /app node:16 yarn coding-standards-check
-docker run --rm --volume ${PWD}:/app --workdir /app node:16 yarn coding-standards-apply
+docker compose run --rm node yarn install
+docker compose run --rm node yarn coding-standards-check
+docker compose run --rm node yarn coding-standards-apply
 ```
 
 ### GitHub Actions
@@ -163,18 +192,16 @@ act -P ubuntu-latest=shivammathur/node:focal pull_request
 To run only twigcs:
 
 ```sh
-composer coding-standards-check/twigcs
+docker compose exec phpfpm composer coding-standards-check/twigcs
 ```
 
 But this is also a part of
 
 ```sh
-composer coding-standards-check
+docker compose exec phpfpm composer coding-standards-check
 ```
 
-## Build assets
+## Build theme assets
 
-```sh
-docker run --rm  --volume ${PWD}:/app --workdir /app node:16 yarn install
-docker run --rm  --volume ${PWD}:/app --workdir /app node:16 yarn encore dev
-```
+See
+[os2loop_theme/README.md](web/profiles/custom/os2loop/themes/os2loop_theme/README.md).

Taskfile.yml

@@ -0,0 +1,13 @@
+version: '3'
+
+dotenv:
+  - '.env.docker.local'
+
+includes:
+  dev:
+    taskfile: task/
+
+  server:
+    taskfile: task/
+    vars:
+      DOCKER_COMPOSE: itkdev-docker-compose-server