Upgrade/php85 symfony74

.docker/apache-vhost.conf

@@ -9,6 +9,14 @@
         Require all granted
     </Directory>
 
+    # Client IP read from X-Forwarded-For when the request comes from a reverse proxy
+    # (ingress, traefik) on a private network, same ranges as TRUSTED_PROXIES=PRIVATE_SUBNETS.
+    RemoteIPHeader X-Forwarded-For
+    RemoteIPInternalProxy 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 ::1 fc00::/7 fe80::/10
+
+    # "combined" with the client IP (%a, set by mod_remoteip) instead of the proxy IP (%h)
+    LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined_client_ip
+
 	ErrorLog ${APACHE_LOG_DIR}/error.log
-	CustomLog ${APACHE_LOG_DIR}/access.log combined
+	CustomLog ${APACHE_LOG_DIR}/access.log combined_client_ip
 </VirtualHost>

.dockerignore

@@ -4,3 +4,10 @@ var
 /node_modules/
 
 /.env.*
+
+# front assets are built in the Dockerfile
+/public/build/
+/public/vendor/
+/public/css/
+/public/font/
+/public/img/

.env

@@ -19,6 +19,15 @@
 VALIDATOR_PATH=%kernel.project_dir%/bin/validator-cli.jar
 VALIDATOR_JAVA_OPTS='-Xms256m -Xmx2g'
 DATA_DIR=%kernel.project_dir%/var/data
+# Allow download of source and normalized data (/api/validations/{uid}/files/*), disabled by default for security reasons
+DATA_DOWNLOAD_ENABLED=0
+# Hosts (comma separated, subdomains included) allowed for the "model" argument (https only)
+VALIDATOR_MODEL_ALLOWED_HOSTS=geoportail-urbanisme.gouv.fr,ignf.github.io
+# Max number of validations created or updated per hour and per client IP
+VALIDATION_RATE_LIMIT=100
+# Reverse proxies (ex : PRIVATE_SUBNETS, REMOTE_ADDR, 10.0.0.0/8) whose X-Forwarded-For is trusted to get the client IP
+# (required behind an ingress / traefik, otherwise all the clients share the rate limit of the proxy IP)
+TRUSTED_PROXIES=PRIVATE_SUBNETS
 
 #---------------------------------------------
 # docker defaults

.github/workflows/docker-publish.yml

@@ -61,7 +61,7 @@ jobs:
         uses: docker/build-push-action@v3
         with:
           context: .
-          file: .docker/Dockerfile
+          file: Dockerfile
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/php-ci.yml

@@ -14,7 +14,7 @@ jobs:
 
     strategy:
       matrix:
-        php-version: [8.3]
+        php-version: [8.5]
 
     runs-on: ubuntu-latest
 
@@ -65,7 +65,7 @@ jobs:
         DATABASE_URL: postgresql://postgres:postgres@localhost:5432/validator_api?serverVersion=14&charset=utf8
 
     - name: Upload coverage results to coveralls.io
-      if: github.ref == 'refs/heads/master' && matrix.php-version == '8.3'
+      if: github.ref == 'refs/heads/master' && matrix.php-version == '8.5'
       run: |
         vendor/bin/php-coveralls --coverage_clover=var/data/output/coverage.xml --json_path=var/data/output/coveralls.json -v
       env:

.gitignore

@@ -18,16 +18,12 @@ validator-debug.log
 /nbproject/
 
 /tests/TempData/*
-/*.lock
-/package-lock.json
 
 /.idea
 /.vscode
 
 validator-cli.jar
 
-.scannerwork
-sonar-scanner
 node_modules
 
 /output/
@@ -45,3 +41,10 @@ node_modules
 /phpunit.xml
 .phpunit.result.cache
 ###< phpunit/phpunit ###
+
+# front assets built by webpack (npm ci && npm run build), see webpack.config.js
+/public/build/
+/public/vendor/
+/public/css/
+/public/font/
+/public/img/