App Platform spec: move DEPLOYMENT_IDENTIFIER/PHP_INI_SCAN_DIR to global

neurocracy · Oct 2, 2023 · 5bb9f30 · 5bb9f30
1 parent 2dd43e7
commit 5bb9f30
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 44 deletions.
diff --git a/.do/app.yaml b/.do/app.yaml
@@ -24,6 +24,13 @@ envs:
  scope: BUILD_TIME
  type: SECRET
  value: '{"github-oauth":{"github.com": "_GITHUB_TOKEN_"}}'
+ # This must be specified for all components to ensure they don't differ and
+ # cause Drupal to rebuild the container needlessly. Since they all get
+ # deployed from the same repository and same commit each time, they should be
+ # identical.
+- key: DEPLOYMENT_IDENTIFIER
+ scope: RUN_AND_BUILD_TIME
+ value: ${_self.COMMIT_HASH}
 - key: DISCOURSE_CONNECT_SECRET
  scope: RUN_TIME
  type: SECRET
@@ -82,6 +89,13 @@ envs:
 - key: DRUSH_OPTIONS_URI
  scope: RUN_AND_BUILD_TIME
  value: ${APP_URL}
+ # Append our PHP settings directory. Note the leading ":" which tells PHP to
+ # scan all the default locations first before appending ours; without the ":",
+ # PHP would ignore all the default locations and only use our settings, which
+ # only contain a small subset of PHP settings and would likely do bad things.
+- key: PHP_INI_SCAN_DIR
+ scope: RUN_AND_BUILD_TIME
+ value: :/workspace/.php/
 - key: SPACES_ACCESS
  scope: RUN_TIME
  type: SECRET
@@ -112,17 +126,6 @@ ingress:
 services:
 - build_command: .do/build-web.sh
  environment_slug: php
- envs:
- # This must be specified for both the web component and background tasks to
- # ensure they don't differ and cause Drupal to rebuild the container
- # needlessly. Since they both get deployed from the same repository and same
- # commit each time, they should be identical.
- - key: DEPLOYMENT_IDENTIFIER
- scope: RUN_AND_BUILD_TIME
- value: ${_self.COMMIT_HASH}
- - key: PHP_INI_SCAN_DIR
- scope: RUN_AND_BUILD_TIME
- value: :/workspace/.php/
  github:
  branch: 9.x
  repo: neurocracy/omnipedia
@@ -142,17 +145,6 @@ services:
 workers:
 - build_command: .do/build-background-tasks.sh
  environment_slug: php
- envs:
- # This must be specified for both the web component and background tasks to
- # ensure they don't differ and cause Drupal to rebuild the container
- # needlessly. Since they both get deployed from the same repository and same
- # commit each time, they should be identical.
- - key: DEPLOYMENT_IDENTIFIER
- scope: RUN_AND_BUILD_TIME
- value: ${_self.COMMIT_HASH}
- - key: PHP_INI_SCAN_DIR
- scope: RUN_AND_BUILD_TIME
- value: :/workspace/.php/
  github:
  branch: 9.x
  repo: neurocracy/omnipedia

diff --git a/.do/deploy.template.yaml b/.do/deploy.template.yaml
@@ -26,6 +26,13 @@ spec:
  scope: BUILD_TIME
  type: SECRET
  value: '{"github-oauth":{"github.com": "_GITHUB_TOKEN_"}}'
+ # This must be specified for all components to ensure they don't differ and
+ # cause Drupal to rebuild the container needlessly. Since they all get
+ # deployed from the same repository and same commit each time, they should be
+ # identical.
+ - key: DEPLOYMENT_IDENTIFIER
+ scope: RUN_AND_BUILD_TIME
+ value: ${_self.COMMIT_HASH}
  - key: DISCOURSE_CONNECT_SECRET
  scope: RUN_TIME
  type: SECRET
@@ -84,6 +91,13 @@ spec:
  - key: DRUSH_OPTIONS_URI
  scope: RUN_AND_BUILD_TIME
  value: ${APP_URL}
+ # Append our PHP settings directory. Note the leading ":" which tells PHP to
+ # scan all the default locations first before appending ours; without the ":",
+ # PHP would ignore all the default locations and only use our settings, which
+ # only contain a small subset of PHP settings and would likely do bad things.
+ - key: PHP_INI_SCAN_DIR
+ scope: RUN_AND_BUILD_TIME
+ value: :/workspace/.php/
  - key: SPACES_ACCESS
  scope: RUN_TIME
  type: SECRET
@@ -114,17 +128,6 @@ spec:
  services:
  - build_command: .do/build-web.sh
  environment_slug: php
- envs:
- # This must be specified for both the web component and background tasks to
- # ensure they don't differ and cause Drupal to rebuild the container
- # needlessly. Since they both get deployed from the same repository and same
- # commit each time, they should be identical.
- - key: DEPLOYMENT_IDENTIFIER
- scope: RUN_AND_BUILD_TIME
- value: ${_self.COMMIT_HASH}
- - key: PHP_INI_SCAN_DIR
- scope: RUN_AND_BUILD_TIME
- value: :/workspace/.php/
  github:
  branch: 9.x
  repo: neurocracy/omnipedia
@@ -144,17 +147,6 @@ spec:
  workers:
  - build_command: .do/build-background-tasks.sh
  environment_slug: php
- envs:
- # This must be specified for both the web component and background tasks to
- # ensure they don't differ and cause Drupal to rebuild the container
- # needlessly. Since they both get deployed from the same repository and same
- # commit each time, they should be identical.
- - key: DEPLOYMENT_IDENTIFIER
- scope: RUN_AND_BUILD_TIME
- value: ${_self.COMMIT_HASH}
- - key: PHP_INI_SCAN_DIR
- scope: RUN_AND_BUILD_TIME
- value: :/workspace/.php/
  github:
  branch: 9.x
  repo: neurocracy/omnipedia