Merge branch 'production' into test

MartinPaulEve · MartinPaulEve · commit 40c026c52454 · 2026-06-16T11:57:58.000+01:00
Bring the nginx routing restructure, network-scoped /members/ Profiles
redirects, container healthchecks, and CI updates onto the test
deployment branch. WordPress stays on 6.8.1 (the WP7 upgrade on dev is
excluded, matching production and main).

# Conflicts:
#	config/test/nginx/templates/25-buddypress-redirects.conf.template
diff --git a/Dockerfile.php b/Dockerfile.php
@@ -161,5 +161,8 @@
         > /app/site/web/.version.json && \
     chown www-data:www-data /app/site/web/.version.json
 
+# used for health check endpoint
+RUN apk add --no-cache fcgi
+
 ENTRYPOINT ["/app/scripts/build-scripts/docker-php-entrypoint.sh"]
 CMD ["php-fpm"]
diff --git a/composer.json b/composer.json
@@ -134,7 +134,7 @@
     "wp-plugin/tainacan": "^1.0.1",
     "wp-plugin/cool-timeline": "^3.0.8",
     "mesh-research/cc-client": "dev-main",
-    "mesh-research/kcworks-on-wp": "1.0.3",
+    "mesh-research/kcworks-on-wp": "1.3.1",
     "wp-plugin/feedzy-rss-feeds": "^4.4",
     "wp-plugin/zotpress": "^7.4.1",
     "php-http/guzzle7-adapter": "^1.0",
diff --git a/composer.lock b/composer.lock
diff --git a/config/all/nginx/templates/00-hcommons.conf.template b/config/all/nginx/templates/00-hcommons.conf.template
@@ -10,6 +10,18 @@ map $http_origin $allow_origin {
     default "";
 }
 
+#
+# Resolve the network a request belongs to, for the /members/ redirects to
+# the Profiles application. Hosts on their own (custom) domains are mapped
+# to a network name by the per-environment alias file; every other host
+# falls back to the subdomain captured from the server_name regex below.
+#
+map $host $network_subdomain {
+    hostnames;
+    default $subdomain;
+    include /etc/nginx/conf.d/05-network-domain-aliases.conf;
+}
+
 server {
   listen [::]:80;
   listen 80;
@@ -79,6 +91,12 @@ server {
     deny all;
   }
 
+  # Container healthcheck endpoint
+  location = /healthz {
+      access_log off;
+      return 200 "ok";
+  }
+
   # Prevent BuddyPress docs from being accessed directly.
   location /app/uploads/bp-attachments/ {
     rewrite ^/app/uploads/bp-attachments/([0-9]+)/(.*) https://$http_x_forwarded_host/?p=$1&bp-attachment=$2 permanent;
diff --git a/config/all/nginx/templates/05-network-domain-aliases.conf.template b/config/all/nginx/templates/05-network-domain-aliases.conf.template
@@ -0,0 +1,19 @@
+# Custom-domain -> network aliases, included into the $network_subdomain
+# map in 00-hcommons.conf.template.
+#
+# Sites that live on their own domains (rather than a subdomain of
+# DOMAIN_NAME) cannot have their network inferred from the Host header,
+# so list them here. Each entry maps a hostname to the network subdomain
+# used on the Profiles application host.
+#
+# A leading dot matches the domain itself and any subdomain of it:
+#
+#   .commons.msu.edu msu;
+#
+# sends commons.msu.edu/members/ (and asite.commons.msu.edu/members/)
+# to https://msu.profile.<instance domain>/members/.
+#
+# This file is the environment-neutral default and defines no aliases.
+# Per-environment entries live in
+# config/<env>/nginx/templates/05-network-domain-aliases.conf.template,
+# which overrides this file at image build time.
diff --git a/config/all/php/www.conf b/config/all/php/www.conf
@@ -9,4 +9,6 @@ pm.max_children = ${PM_MAX_CHILDREN}
 pm.start_servers = ${PM_START_SERVERS}
 pm.min_spare_servers = ${PM_MIN_SPARE_SERVERS}
 pm.max_spare_servers = ${PM_MAX_SPARE_SERVERS}
-pm.max_requests = ${PM_MAX_REQUESTS}
+pm.max_requests = ${PM_MAX_REQUESTS}
+ping.path = /ping
+ping.response = pong
diff --git a/config/dev/nginx/templates/05-network-domain-aliases.conf.template b/config/dev/nginx/templates/05-network-domain-aliases.conf.template
@@ -0,0 +1,5 @@
+# Custom-domain -> network aliases for dev. See
+# config/all/nginx/templates/05-network-domain-aliases.conf.template
+# for the entry format.
+
+.msucommons-dev.org msu;
diff --git a/config/dev/nginx/templates/25-buddypress-redirects.conf.template b/config/dev/nginx/templates/25-buddypress-redirects.conf.template
@@ -1,7 +1,14 @@
 # this has to be ordered after 20-buddypress.conf.template has been loaded
 
-# Member profile redirects to new Profiles application
+# Member profile redirects to new Profiles application.
+# Requests belonging to a network (resolved by the $network_subdomain map
+# in 00-hcommons.conf.template, from either the request subdomain or a
+# custom-domain alias) carry the network as a subdomain of the Profiles
+# host so Profiles can scope the member list to that network.
 location /members/ {
+        if ($network_subdomain) {
+                return 301 https://$network_subdomain.profile.hcommons-dev.org$request_uri;
+        }
         return 301 https://profile.hcommons-dev.org$request_uri;
 }
 
diff --git a/config/production/nginx/templates/05-network-domain-aliases.conf.template b/config/production/nginx/templates/05-network-domain-aliases.conf.template
@@ -0,0 +1,10 @@
+# Custom-domain -> network aliases for production. See
+# config/all/nginx/templates/05-network-domain-aliases.conf.template
+# for the entry format.
+
+# iteach.msu.edu needs no entry: 40-redirects.conf.template redirects it
+# wholesale to iteach.commons.msu.edu, which the .commons.msu.edu entry
+# covers.
+.commons.msu.edu msu;
+.action.mla.org mla;
+.symposium.mla.org mla;
diff --git a/config/production/nginx/templates/25-buddypress-redirects.conf.template b/config/production/nginx/templates/25-buddypress-redirects.conf.template
@@ -0,0 +1,18 @@
+# this has to be ordered after 20-buddypress.conf.template has been loaded
+
+# Member profile redirects to new Profiles application.
+# Requests belonging to a network (resolved by the $network_subdomain map
+# in 00-hcommons.conf.template, from either the request subdomain or a
+# custom-domain alias) carry the network as a subdomain of the Profiles
+# host so Profiles can scope the member list to that network.
+location /members/ {
+        if ($network_subdomain) {
+                return 301 https://$network_subdomain.profile.hcommons.org$request_uri;
+        }
+        return 301 https://profile.hcommons.org$request_uri;
+}
+
+# Member registration page redirects to new Profiles application
+location /membership/ {
+        return 301 https://profile.hcommons.org/registration/start/;
+}
diff --git a/config/staging/nginx/templates/25-buddypress-redirects.conf.template b/config/staging/nginx/templates/25-buddypress-redirects.conf.template
@@ -0,0 +1,18 @@
+# this has to be ordered after 20-buddypress.conf.template has been loaded
+
+# Member profile redirects to new Profiles application.
+# Requests belonging to a network (resolved by the $network_subdomain map
+# in 00-hcommons.conf.template, from either the request subdomain or a
+# custom-domain alias) carry the network as a subdomain of the Profiles
+# host so Profiles can scope the member list to that network.
+location /members/ {
+        if ($network_subdomain) {
+                return 301 https://$network_subdomain.profile.hcommons-staging.org$request_uri;
+        }
+        return 301 https://profile.hcommons-staging.org$request_uri;
+}
+
+# Member registration page redirects to new Profiles application
+location /membership/ {
+        return 301 https://profile.hcommons-staging.org/registration/start/;
+}
diff --git a/config/test/nginx/templates/25-buddypress-redirects.conf.template b/config/test/nginx/templates/25-buddypress-redirects.conf.template
@@ -1,7 +1,14 @@
 # this has to be ordered after 20-buddypress.conf.template has been loaded
 
-# Member profile redirects to new Profiles application
+# Member profile redirects to new Profiles application.
+# Requests belonging to a network (resolved by the $network_subdomain map
+# in 00-hcommons.conf.template, from either the request subdomain or a
+# custom-domain alias) carry the network as a subdomain of the Profiles
+# host so Profiles can scope the member list to that network.
 location /members/ {
+        if ($network_subdomain) {
+                return 301 https://$network_subdomain.profile.hcommons-test.org$request_uri;
+        }
         return 301 https://profile.hcommons-test.org$request_uri;
 }
 
diff --git a/docs/TASK_DEFINITION_HEALTH_CHECKS.md b/docs/TASK_DEFINITION_HEALTH_CHECKS.md
@@ -0,0 +1,129 @@
+# ECS Task Definition Health Checks
+
+Recommendations for adding container-level health checks to the WordPress ECS
+task definitions (`app` + `nginx`). As of task definition revision 17 (dev),
+neither container defines a `healthCheck`, neither Dockerfile contains a
+`HEALTHCHECK` instruction, and there is no endpoint suitable for probing.
+
+## Current state
+
+- **app** (`Dockerfile.php`) is `php:8.2.26-fpm-alpine3.20` running php-fpm on
+  port 9000. No fcgi probe tools are installed, and
+  `config/all/php/www.conf` does not configure `ping.path`.
+- **nginx** (`Dockerfile.nginx`) is `nginx:stable-alpine3.19` and listens on
+  **port 80 only**. TLS is terminated upstream, so the 443 port mapping in the
+  task definition has no listener behind it — do not health check 443.
+- Every `server` block in
+  `config/all/nginx/templates/hcommons.conf.template` either redirects or
+  serves WordPress; there is no plain 200 endpoint. The existing
+  `location ~ ^/status.php` block has no `fastcgi_pass`, so it falls through
+  to a static file lookup and effectively 404s.
+- Both entrypoints fetch values from AWS Secrets Manager at startup, and the
+  app container additionally symlinks EFS-hosted plugins/themes before
+  starting php-fpm. Startup can take tens of seconds, so `startPeriod`
+  matters.
+- Both images are Alpine-based, so busybox `wget` is available in the nginx
+  container without installing anything.
+
+## 1. app container — php-fpm ping over FastCGI
+
+### Image change (`Dockerfile.php`)
+
+Install the `fcgi` package, which provides `cgi-fcgi`:
+
+```dockerfile
+RUN apk add --no-cache fcgi
+```
+
+### Pool change (`config/all/php/www.conf`)
+
+Enable php-fpm's built-in ping endpoint:
+
+```ini
+ping.path = /ping
+ping.response = pong
+```
+
+### Task definition
+
+```json
+"healthCheck": {
+    "command": ["CMD-SHELL",
+        "REQUEST_METHOD=GET SCRIPT_NAME=/ping SCRIPT_FILENAME=/ping cgi-fcgi -bind -connect 127.0.0.1:9000 | grep -q pong"],
+    "interval": 30,
+    "timeout": 5,
+    "retries": 3,
+    "startPeriod": 90
+}
+```
+
+This exercises a worker over the FastCGI protocol rather than just checking
+that the process exists.
+
+**Zero-image-change stopgap:** `bash` is installed in the app image, so
+`bash -c 'exec 3<>/dev/tcp/127.0.0.1/9000'` works as a health check command
+with no image changes. It only proves the master socket is listening — not
+that workers can serve — so treat it as temporary.
+
+**Note on the listen address:** `www.conf` sets `listen = 127.0.0.1:9000`,
+but the official php-fpm image's `zz-docker.conf` loads after it and
+overrides the listen address to all interfaces — that is why nginx can reach
+`app:9000` at all. The health check probes 127.0.0.1 from inside the
+container, so it works either way.
+
+## 2. nginx container — dedicated /healthz location
+
+### Config change (`config/all/nginx/templates/hcommons.conf.template`)
+
+Add an exact-match location to the `default_server` block. Exact matches take
+precedence over the regex locations, and the default server block has no
+server-level redirect, so a request for `http://127.0.0.1/healthz` lands
+there and returns 200 rather than a 301:
+
+```nginx
+location = /healthz {
+    access_log off;
+    return 200 "ok";
+}
+```
+
+### Task definition
+
+Busybox `wget` exits non-zero on any non-2xx response:
+
+```json
+"healthCheck": {
+    "command": ["CMD-SHELL", "wget -q -T 4 -O /dev/null http://127.0.0.1/healthz || exit 1"],
+    "interval": 30,
+    "timeout": 5,
+    "retries": 3,
+    "startPeriod": 60
+}
+```
+
+This deliberately checks only nginx itself, not the path through to php-fpm.
+The app container has its own check, and coupling the two would cause nginx
+to flap whenever the app restarts.
+
+## 3. Container ordering via dependsOn
+
+The staging task definition already uses `dependsOn` with condition `START`
+on nginx; the dev task definition has none. Once the app container has a
+health check, upgrade the condition so nginx does not start (and snapshot
+`volumesFrom`) until php-fpm is genuinely serving:
+
+```json
+"dependsOn": [
+    { "containerName": "app", "condition": "HEALTHY" }
+]
+```
+
+## Operational caveats
+
+- Container health checks run via `docker exec` on the instance, and a
+  failing check on an `essential` container kills the whole task. The
+  generous `startPeriod` values above (covering the Secrets Manager fetch and
+  EFS symlinking) are load-bearing, not decoration.
+- If the ECS service sits behind an ALB, review the service's
+  `healthCheckGracePeriodSeconds` as well — ALB target health is judged
+  separately from these container checks.
diff --git a/tests/nginx/test-members-redirects.sh b/tests/nginx/test-members-redirects.sh
