feat: the lnmp layer, nginx, MariaDB and PHP-FPM on Keel Web (0059) #1

Merged

navigator merged 3 commits from feat/recipe into main 2026-10-16 03:52:11 -03:00

Conversation 0 Commits 3 Files changed 43 +3548 -2

navigator commented 2026-10-16 03:42:34 -03:00

Owner

Copy link

The lnmp layer of handbook decision 0059 (handbook#90): bt-layer lnmp --parent web.

• PHP-FPM 8.4 and MariaDB 11.8 from Debian 13, through common's php-fpm.mk and mysql.mk. No Adminer, nothing of Apache.
• lnmp.yaml (base web): MariaDB on 3306 mesh, PHP-FPM with no TCP port, the db_password secret, the db_user option. keel validates it along web and core in the stack job and in the build.
• The database files of keel-mariadb are copied (bind to loopback, socket units masked, 35mysqlpass). Its manifest is not carried, because it would be a second top manifest.
• The check page is at /keel-check/, from /etc/nginx/keel-default.d/50-keel-lnmp.conf (keel-web#12), on /run/php/php-fpm.sock. The page reads only, as www-data by unix_socket, with SELECT on keel_check.
• 40lnmp-check writes the boot row with sql_log_bin = 0. It skips on a read-only server, and makes no database when the spec declares a replica.
• Checks: tests / tests (kcov, threshold 95), tests / stack (a booted trixie container), tests / appliance (allow_unpublished until the first release), tests / package, security / security.

The lnmp layer of handbook decision 0059 (handbook#90): `bt-layer lnmp --parent web`. - PHP-FPM 8.4 and MariaDB 11.8 from Debian 13, through common's `php-fpm.mk` and `mysql.mk`. No Adminer, nothing of Apache. - `lnmp.yaml` (base `web`): MariaDB on 3306 `mesh`, PHP-FPM with no TCP port, the `db_password` secret, the `db_user` option. keel validates it along web and core in the stack job and in the build. - The database files of keel-mariadb are copied (bind to loopback, socket units masked, `35mysqlpass`). Its manifest is not carried, because it would be a second top manifest. - The check page is at `/keel-check/`, from `/etc/nginx/keel-default.d/50-keel-lnmp.conf` (keel-web#12), on `/run/php/php-fpm.sock`. The page reads only, as `www-data` by `unix_socket`, with SELECT on `keel_check`. - `40lnmp-check` writes the boot row with `sql_log_bin = 0`. It skips on a read-only server, and makes no database when the spec declares a replica. - Checks: `tests / tests` (kcov, threshold 95), `tests / stack` (a booted trixie container), `tests / appliance` (`allow_unpublished` until the first release), `tests / package`, `security / security`.

navigator added 1 commit 2026-10-16 03:42:34 -03:00

feat: the lnmp layer, nginx, MariaDB and PHP-FPM on Keel Web (0059) ... d3ca17e222

A layer on web with PHP-FPM 8.4 and MariaDB 11.8 from Debian 13. The
manifest lnmp.yaml (base web) declares MariaDB on a mesh port, PHP-FPM,
the db_password secret and the db_user option, so a spec may declare the
pair of 0049. The database files of keel-mariadb are copied, because its
manifest would be a second top manifest. The check page /keel-check/
reads from MariaDB as www-data by unix_socket, with SELECT on keel_check
only; firstboot.d/40lnmp-check writes its row with sql_log_bin = 0.
Tests: bats under kcov, a stack job on a booted trixie container, and
the boot test with allow_unpublished until the first release.

navigator added 1 commit 2026-10-16 03:47:13 -03:00

ci: the stack job fetches the pinned sources from the GitHub mirrors ... 2bf9969678

The job container did not reach git.pop.coop on port 443.

navigator added 1 commit 2026-10-16 03:49:46 -03:00

ci: the stack job turns the binary log on, so the sql_log_bin test runs 1fd2aad0d6

navigator merged commit fcd8c081c3 into main 2026-10-16 03:52:11 -03:00

navigator referenced this pull request from a commit 2026-10-16 03:52:12 -03:00

Merge pull request 'feat: the lnmp layer, nginx, MariaDB and PHP-FPM on Keel Web (0059)' (#1) from feat/recipe into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Keel-Linux/keel-lnmp!1

No description provided.