The shared web layer: Apache, PHP and Adminer on core #1

Merged

marcos-mendez merged 2 commits from feat/the-shared-web-layer into main

2026-09-27 16:59:11 -03:00

marcos-mendez commented

2026-09-27 16:52:24 -03:00

(Migrated from github.com)

What is here

The intersection of the two upstream recipes and nothing either one does not have:


from `common`	`apache.mk`, `php.mk`, `adminer.mk`, `composer.mk`, and the conf scripts `apache-vhost`, `apache-headers`, `apache-security`, `apache-ssl`, `php`, `adminer`, `adminer-apache`, `apache-cgi`, `tkl-webcp`
planned	apache2, libapache2-mod-php, php-cli, mod_security2, mod_evasive, mod_perl2, webmin-apache, webmin-phpini, adminer, libjs-jush, composer
overlay	the default site serving `/var/www` on 80 and 443, `status.conf`, `phpinfo.php`, `cgi-bin/test.cgi`, the files both stacks carry byte for byte
`conf.d/main`	mod_cgi enabled and the webcp icon set both stacks keep, then checks: the three `Listen` lines, five enabled modules and mod_php, the two enabled sites, the document root, PHP on the command line

What is left to the stacks, with the reason for each, is in README.rst: the database unit, the Adminer configuration that names a database, the landing page, the confconsole overlay, each stack's extra drivers, and LAMP's Upgrade header.

Built and booted on the build host

bt-layer apache-php --parent core at SOURCE_DATE_EPOCH=1700000000, fab 1.1.1+keel2, parent core 7acf2c53: 129 seconds, 492 packages, 37,362 files, 3,540 symlinks, 56,133,883 bytes, sha256 b9dd64db. bt-layer put turnkey.d/zz-ssl-ciphers in the child conf list on its own, because conf/apache-ssl carries the mark, which is the fix merged into buildtasks earlier today doing its job.

The boot test, on a container assembled from core plus this layer, everything over the container's global IPv6 address, 25 seconds from boot to verdict:

boot-test: apache answered 200 on port 80 over IPv6
boot-test: apache over TLS answered 200 on port 443 over IPv6
boot-test: PHP executed ('PHP Version' in the body of /phpinfo.php)
boot-test: PHP executed ('PHP Version' in the body of /phpinfo.php)
boot-test: the CGI script answered 200 on port 80 over IPv6
boot-test: the CGI handler ran /cgi-bin/test.cgi
boot-test: adminer answered 200 on port 12322 over IPv6
boot-test: adminer answered with its own page on port 12322
boot-test: webmin-apache is installed
boot-test: webmin answered 200 on port 12321
keel diff: no drift, but a declared field could not be observed offline
boot-test: apache-php boot test passed

The first run of that test failed, and the failure was the test's: Adminer's vhost opens with SSLEngine on, so 12322 is TLS only and a plain HTTP request there is answered 400 by Apache rather than by Adminer. The second commit fixes it and checks the page as well as the code.

Tests

45 bats tests, kcov 100 percent (177/177) on tests/lib/boot-test-lib.sh, gate raised from the bootstrap 0 to 100. COVERAGE.md records that this is the fifth copy of that library and that moving its shared half into keel-linux/.github is now due, before LAMP and LAPP add a sixth and a seventh.

Test plan:

bats tests/boot-test.bats, 45 tests
COVERAGE_THRESHOLD=100 tests/coverage.sh
built on the build host and booted in LXC, output above
appliance / build-and-boot, which fetches the published layer: it becomes a required status once the layer is on the mirror. Nothing was published, the layer is staged in /mnt/builds/layers.

The third step of decision 0013's layer model, after the two database components. Upstream, LAMP and LAPP each install the same web stack, because each is built around its own database; with the database carried by a unit instead of being a parent layer, the web half is built once and both stacks are built on it. That sharing is the reason the unit work of decision 0010 exists, so this is where it pays off. ## What is here The intersection of the two upstream recipes and nothing either one does not have: | | | | --- | --- | | from `common` | `apache.mk`, `php.mk`, `adminer.mk`, `composer.mk`, and the conf scripts `apache-vhost`, `apache-headers`, `apache-security`, `apache-ssl`, `php`, `adminer`, `adminer-apache`, `apache-cgi`, `tkl-webcp` | | planned | apache2, libapache2-mod-php, php-cli, mod_security2, mod_evasive, mod_perl2, webmin-apache, webmin-phpini, adminer, libjs-jush, composer | | overlay | the default site serving `/var/www` on 80 and 443, `status.conf`, `phpinfo.php`, `cgi-bin/test.cgi`, the files both stacks carry byte for byte | | `conf.d/main` | mod_cgi enabled and the webcp icon set both stacks keep, then checks: the three `Listen` lines, five enabled modules and mod_php, the two enabled sites, the document root, PHP on the command line | What is left to the stacks, with the reason for each, is in README.rst: the database unit, the Adminer configuration that names a database, the landing page, the confconsole overlay, each stack's extra drivers, and LAMP's Upgrade header. ## Built and booted on the build host `bt-layer apache-php --parent core` at `SOURCE_DATE_EPOCH=1700000000`, fab 1.1.1+keel2, parent `core` `7acf2c53`: **129 seconds**, 492 packages, 37,362 files, 3,540 symlinks, 56,133,883 bytes, sha256 `b9dd64db`. `bt-layer` put `turnkey.d/zz-ssl-ciphers` in the child conf list on its own, because `conf/apache-ssl` carries the mark, which is the fix merged into buildtasks earlier today doing its job. The boot test, on a container assembled from `core` plus this layer, everything over the container's global IPv6 address, 25 seconds from boot to verdict: boot-test: apache answered 200 on port 80 over IPv6 boot-test: apache over TLS answered 200 on port 443 over IPv6 boot-test: PHP executed ('PHP Version' in the body of /phpinfo.php) boot-test: PHP executed ('PHP Version' in the body of /phpinfo.php) boot-test: the CGI script answered 200 on port 80 over IPv6 boot-test: the CGI handler ran /cgi-bin/test.cgi boot-test: adminer answered 200 on port 12322 over IPv6 boot-test: adminer answered with its own page on port 12322 boot-test: webmin-apache is installed boot-test: webmin answered 200 on port 12321 keel diff: no drift, but a declared field could not be observed offline boot-test: apache-php boot test passed The first run of that test failed, and the failure was the test's: Adminer's vhost opens with `SSLEngine on`, so 12322 is TLS only and a plain HTTP request there is answered 400 by Apache rather than by Adminer. The second commit fixes it and checks the page as well as the code. ## Tests 45 bats tests, kcov **100 percent (177/177)** on `tests/lib/boot-test-lib.sh`, gate raised from the bootstrap 0 to 100. COVERAGE.md records that this is the fifth copy of that library and that moving its shared half into `keel-linux/.github` is now due, before LAMP and LAPP add a sixth and a seventh. Test plan: - [x] `bats tests/boot-test.bats`, 45 tests - [x] `COVERAGE_THRESHOLD=100 tests/coverage.sh` - [x] built on the build host and booted in LXC, output above - [ ] `appliance / build-and-boot`, which fetches the published layer: it becomes a required status once the layer is on the mirror. Nothing was published, the layer is staged in `/mnt/builds/layers`.

Commenting is not possible because the repository is archived.

No reviewers