Files
phpfpm/templates/deployment.yaml
T
claudeandClaude Fable 5 8ff43615fa
Helm Chart Release / release-chart (push) Successful in 5s
feat: Composer導入先をWebルート外(/var/www)に変更 (v8.5.6-a)
従来はWebルート /var/www/html 直下にComposerを導入していたため、
composer.json / composer.lock / vendor/ がWeb経由で公開され、
依存パッケージ情報の漏洩などのセキュリティリスクがあった。

- values.yaml: composer.workingDir を追加(デフォルト: /var/www)
- templates/deployment.yaml: 作業ディレクトリを workingDir に変更、
  Webルート以外の場合はPVCの composer サブパスをマウントして永続化
- README.md: パラメータ説明・autoload読み込みパスの解説を追加
- Chart.yaml: 8.5.6-a(手動リリース)
- CHANGELOG-8.5.6-a.md: 変更内容を記録

PHP側は require_once '/var/www/vendor/autoload.php'; で読み込む。
旧動作へは composer.workingDir: "/var/www/html" で復帰可能。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-19 14:29:23 +09:00

284 lines
11 KiB
YAML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "phpfpm.fullname" . }}
labels:
{{- include "phpfpm.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
{{- include "phpfpm.selectorLabels" . | nindent 6 }}
template:
metadata:
labels:
{{- include "phpfpm.selectorLabels" . | nindent 8 }}
spec:
containers:
- name: nginx
image: "{{ .Values.image.nginx.registry }}/{{ .Values.image.nginx.repository }}:{{ .Values.image.nginx.tag }}"
imagePullPolicy: {{ .Values.image.nginx.pullPolicy }}
ports:
- containerPort: 80
volumeMounts:
- name: app-storage
mountPath: /var/www/html
subPath: html
- name: nginx-config
mountPath: /etc/nginx/nginx.conf
subPath: nginx.conf
- name: php-fpm
image: "{{ .Values.image.php.registry }}/{{ .Values.image.php.repository }}:{{ .Values.image.php.tag }}"
imagePullPolicy: {{ .Values.image.php.pullPolicy }}
command:
- sh
- -c
- |
echo "Starting PHP-FPM setup process..."
{{- if or .Values.composer.enabled .Values.selenium.enabled .Values.externalDatabase.enabled }}
# ========================================
# APKパッケージのインストール
# ========================================
APK_PACKAGES=""
{{- if or .Values.composer.enabled .Values.selenium.enabled }}
# Composer本体に必要なパッケージ
APK_PACKAGES="$APK_PACKAGES curl zip libzip-dev"
{{- end }}
{{- if .Values.externalDatabase.enabled }}
# MySQL/MariaDB接続に必要なパッケージ
APK_PACKAGES="$APK_PACKAGES mysql-client mysql-dev"
{{- end }}
{{- if .Values.smtp.enabled }}
# SMTP送信に必要なパッケージ
APK_PACKAGES="$APK_PACKAGES msmtp ca-certificates"
{{- end }}
{{- if .Values.composer.additionalApkPackages }}
# ユーザー指定の追加APKパッケージ
{{- range .Values.composer.additionalApkPackages }}
APK_PACKAGES="$APK_PACKAGES {{ . }}"
{{- end }}
{{- end }}
# GD拡張の依存パッケージを自動的に追加
{{- if .Values.composer.additionalPhpExtensions }}
for ext in {{ join " " .Values.composer.additionalPhpExtensions }}; do
if [ "$ext" = "gd" ]; then
echo "GD extension detected, adding required dependencies..."
APK_PACKAGES="$APK_PACKAGES libpng-dev libjpeg-turbo-dev freetype-dev"
break
fi
done
{{- end }}
if [ -n "$APK_PACKAGES" ]; then
echo "Installing APK packages: $APK_PACKAGES"
apk add --no-cache $APK_PACKAGES
fi
# ========================================
# PHP拡張のインストール
# ========================================
{{- if or .Values.composer.enabled .Values.selenium.enabled }}
echo "Installing PHP zip extension..."
docker-php-ext-install zip
{{- end }}
{{- if .Values.externalDatabase.enabled }}
echo "Installing pdo_mysql extension..."
docker-php-ext-install pdo_mysql
{{- end }}
{{- if .Values.composer.additionalPhpExtensions }}
echo "Installing additional PHP extensions..."
{{- range .Values.composer.additionalPhpExtensions }}
docker-php-ext-install {{ . }}
{{- end }}
{{- end }}
# ========================================
# Composerのインストールと実行
# ========================================
{{- if or .Values.composer.enabled .Values.selenium.enabled }}
echo "Installing Composer..."
curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
# Composer導入先(デフォルトはWebルート外の /var/www
mkdir -p {{ .Values.composer.workingDir | default "/var/www" }}
cd {{ .Values.composer.workingDir | default "/var/www" }}
{{- if .Values.composer.enabled }}
# ユーザー定義のComposer設定
{{- if .Values.composer.useComposerJson }}
# composer.jsonファイルを使用
echo "Creating composer.json from values..."
cat > composer.json << 'COMPOSER_JSON_EOF'
{{ .Values.composer.composerJson }}
COMPOSER_JSON_EOF
{{- if .Values.composer.composerLock }}
echo "Creating composer.lock from values..."
cat > composer.lock << 'COMPOSER_LOCK_EOF'
{{ .Values.composer.composerLock }}
COMPOSER_LOCK_EOF
{{- end }}
echo "Running composer install..."
composer install {{ .Values.composer.installOptions }}
{{- else if .Values.composer.packages }}
# パッケージリストから直接インストール
echo "Installing Composer packages..."
{{- range .Values.composer.packages }}
composer require {{ . }}
{{- end }}
{{- if .Values.composer.installOptions }}
# オプティマイズ実行
composer install {{ .Values.composer.installOptions }}
{{- end }}
{{- else }}
# composer.jsonが既に存在する場合はそれを使用
if [ -f composer.json ]; then
echo "Found existing composer.json, running composer install..."
composer install {{ .Values.composer.installOptions }}
else
echo "No composer configuration found, skipping package installation"
fi
{{- end }}
{{- end }}
{{- if .Values.selenium.enabled }}
# Selenium用のパッケージインストール(レガシー互換性)
echo "Installing Selenium WebDriver package..."
composer require php-webdriver/webdriver
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.smtp.enabled }}
# ========================================
# SMTP設定(msmtp
# ========================================
echo "Configuring SMTP for mail sending..."
# msmtprc設定ファイルをコピー
cp /etc/smtp-config/msmtprc /etc/msmtprc
chmod 600 /etc/msmtprc
# PHP設定をphp.ini.d/に作成
cat > /usr/local/etc/php/conf.d/99-smtp.ini << 'PHP_SMTP_EOF'
; SMTP設定 - msmtp経由でメール送信
sendmail_path = "/usr/bin/msmtp -t"
sendmail_from = "{{ .Values.smtp.from }}"
PHP_SMTP_EOF
echo "SMTP configured:"
echo " Host: {{ .Values.smtp.host }}:{{ .Values.smtp.port }}"
echo " Protocol: {{ .Values.smtp.protocol }}"
echo " From: {{ .Values.smtp.from }}"
{{- end }}
echo "Setup complete, starting PHP-FPM..."
php-fpm
ports:
- containerPort: 9000 # PHP-FPMは9000ポートでリッスン
volumeMounts:
- name: app-storage
mountPath: /var/www/html
subPath: html
{{- $composerDir := .Values.composer.workingDir | default "/var/www" }}
{{- if and (or .Values.composer.enabled .Values.selenium.enabled) (ne $composerDir "/var/www/html") }}
# Composer導入先をPVCに永続化(Pod再起動時のvendor再構築を回避)
- name: app-storage
mountPath: {{ $composerDir }}
subPath: composer
{{- end }}
{{- if and .Values.composer.enabled .Values.composer.useComposerJson }}
- name: composer-config
mountPath: /tmp/composer-init
{{- end }}
{{- if .Values.smtp.enabled }}
- name: smtp-config
mountPath: /etc/smtp-config
readOnly: true
{{- if .Values.smtp.auth.enabled }}
- name: smtp-secrets
mountPath: /etc/smtp-secrets
readOnly: true
{{- end }}
{{- end }}
env:
{{- if .Values.externalDatabase.enabled }}
- name: DB_HOST
value: {{ .Values.externalDatabase.host | quote }}
- name: DB_PORT
value: {{ .Values.externalDatabase.port | quote }}
- name: DB_NAME
value: {{ .Values.externalDatabase.database | quote }}
- name: DB_USER
value: {{ .Values.externalDatabase.username | quote }}
- name: DB_PASS
valueFrom:
secretKeyRef:
name: {{ include "phpfpm.fullname" . }}-db-secret
key: {{ include "phpfpm.fullname" . }}-db-key
{{- end }}
{{- range $key, $value := .Values.phpEnv }}
- name: {{ $key }}
value: {{ $value | quote }}
{{- end }}
{{- if .Values.selenium.enabled }}
- name: selenium
image: "{{ .Values.image.selenium.registry }}/{{ .Values.image.selenium.repository }}:{{ .Values.image.selenium.tag }}"
imagePullPolicy: {{ .Values.image.selenium.pullPolicy }}
ports:
- containerPort: 4444 # Selenium用ポート
volumeMounts:
- name: app-storage
mountPath: /var/www/html
subPath: html
{{- end }}
dnsPolicy: ClusterFirst
dnsConfig:
options:
- name: ndots
value: "1"
volumes:
- name: app-storage
{{- if .Values.persistence.enabled }}
persistentVolumeClaim:
claimName: {{ include "phpfpm.fullname" . }}-pvc
{{- else }}
emptyDir: {}
{{- end }}
- name: nginx-config
configMap:
name: {{ include "phpfpm.fullname" . }}-nginx-config
{{- if and .Values.composer.enabled .Values.composer.useComposerJson }}
- name: composer-config
configMap:
name: {{ include "phpfpm.fullname" . }}-composer-config
{{- end }}
{{- if .Values.smtp.enabled }}
- name: smtp-config
configMap:
name: {{ include "phpfpm.fullname" . }}-smtp-config
items:
- key: msmtprc
path: msmtprc
{{- if .Values.smtp.auth.enabled }}
- name: smtp-secrets
secret:
secretName: {{ include "phpfpm.fullname" . }}-smtp
items:
- key: password
path: password
mode: 0600
{{- end }}
{{- end }}