v2.0.0

.dockerignore

@@ -0,0 +1,16 @@
+# Keep the build context small. vendor/ is reinstalled by the php-fpm build and
+# node_modules/ is not needed in the image; both are provided at runtime via the
+# bind mount (and the entrypoint reinstalls vendor if the mount lacks it).
+.git
+node_modules
+vendor
+public/build
+public/hot
+storage/framework/cache/data
+storage/framework/sessions
+storage/framework/views
+storage/logs
+*.log
+.phpunit.result.cache
+.idea
+.vscode

.env.docker

@@ -0,0 +1,59 @@
+# Environment for the docker-compose.dev.yaml stack.
+#
+# Used BOTH as the compose interpolation source (run with
+# `podman compose --env-file .env.docker ...`) AND injected into the app
+# containers via `env_file:`. Because Laravel's dotenv loader is immutable,
+# these injected values win over the bind-mounted host .env — so the app talks
+# to the in-network services (ldap/mariadb) regardless of your host .env.
+#
+# Hosts are compose SERVICE NAMES and ports are the IN-CONTAINER ports. The
+# *_HOST_PORT vars are only the ports published to your host machine.
+
+# php-fpm / workspace run as your host user so bind-mounted files stay writable.
+UID=1000
+GID=1000
+
+APP_NAME=StuMV
+APP_ENV=local
+APP_KEY=base64:GszA3F2jJK0Rdh52FvnWj3MDarPc+ftA+e0MpqqbFMQ=
+APP_DEBUG=true
+APP_URL=http://localhost:8080
+
+LOG_CHANNEL=stack
+LOG_LEVEL=debug
+
+# --- MariaDB (service name "mariadb", in-container port 3306) --------------
+DB_CONNECTION=mysql
+DB_HOST=mariadb
+DB_PORT=3306
+DB_DATABASE=stumv
+DB_USERNAME=stumv
+DB_PASSWORD=local_stumv_password
+DB_HOST_PORT=13306
+# phpMyAdmin web UI (http://localhost:8082)
+DB_ADMIN_PORT=8082
+
+# --- OpenLDAP (service name "ldap", in-container port 1389) ----------------
+# Throwaway dev bind credentials baked into docker/openldap seed data.
+LDAP_ORGANISATION="StuMV"
+LDAP_LOGGING=true
+LDAP_CONNECTION=default
+LDAP_HOST=ldap
+LDAP_PORT=1389
+LDAP_USERNAME="uid=stumv,ou=Services,dc=stumv,dc=de"
+LDAP_PASSWORD=stumv-not-production
+LDAP_BASE_DN="dc=stumv,dc=de"
+LDAP_TIMEOUT=5
+LDAP_SSL=false
+LDAP_TLS=false
+LDAP_HOST_PORT=13389
+# phpLDAPadmin web UI (http://localhost:8081)
+LDAP_ADMIN_PORT=8081
+
+CACHE_DRIVER=file
+SESSION_DRIVER=file
+QUEUE_CONNECTION=sync
+FILESYSTEM_DISK=local
+MAIL_MAILER=log
+
+VITE_PORT=5173

.env.example

@@ -8,13 +8,25 @@ LOG_CHANNEL=stack
 LOG_DEPRECATIONS_CHANNEL=null
 LOG_LEVEL=debug
 
-DB_CONNECTION=mysql
+DB_CONNECTION=mariadb
 DB_HOST=127.0.0.1
 DB_PORT=3306
 DB_DATABASE=lara
 DB_USERNAME=root
 DB_PASSWORD=
 
+LDAP_ORGANISATION="StuMV"
+LDAP_LOGGING=true
+LDAP_CONNECTION=default
+LDAP_HOST=127.0.0.1
+LDAP_USERNAME="cn=admin,dc=stumv,dc=de"
+LDAP_PASSWORD=
+LDAP_PORT=389
+LDAP_BASE_DN="dc=stumv,dc=de"
+LDAP_TIMEOUT=5
+LDAP_TLS=false
+LDAP_STARTTLS=true
+
 BROADCAST_DRIVER=log
 CACHE_DRIVER=file
 FILESYSTEM_DISK=local
@@ -41,4 +53,5 @@ MAIL_FROM_NAME="${APP_NAME}"
 # leave empty or comment out the whole line to remove the entry from the footer
 ABOUT_URL="https://open-administration.de/index.php/kontakt-und-impressum/"
 PRIVACY_URL="https://open-administration.de/index.php/datenschutz/"
-TERMS_URL="https://open-administration.de/index.php/nutzungsbedingungen/"
+TERMS_URL="https://open-administration.de/index.php/nutzungsbedingungen/"
+SOURCE_CODE_URL="https://github.com/openadministration/stumv"

.env.testing

@@ -0,0 +1,40 @@
+# Test environment: runs the suite against the dockerised OpenLDAP (prod-faithful,
+# see docker/openldap/) and a dedicated MariaDB database. Loaded automatically by
+# Laravel when APP_ENV=testing (set in phpunit.xml). CI maps the same services to
+# 127.0.0.1 on these ports, so this file works locally and in CI unchanged.
+APP_NAME=StuMV
+APP_ENV=testing
+APP_KEY=base64:GszA3F2jJK0Rdh52FvnWj3MDarPc+ftA+e0MpqqbFMQ=
+APP_DEBUG=true
+APP_URL=http://localhost
+
+LOG_CHANNEL=stack
+LOG_LEVEL=debug
+
+# Dedicated test database (RefreshDatabase migrates/wipes this — never dev data).
+DB_CONNECTION=mysql
+DB_HOST=127.0.0.1
+DB_PORT=13306
+DB_DATABASE=stumv_testing
+DB_USERNAME=stumv
+DB_PASSWORD=local_stumv_password
+
+# Dockerised OpenLDAP (docker/openldap). Throwaway dev bind credentials baked
+# into the image's seed data — not production secrets.
+LDAP_ORGANISATION="StuMV"
+LDAP_LOGGING=false
+LDAP_CONNECTION=default
+LDAP_HOST=127.0.0.1
+LDAP_PORT=13389
+LDAP_USERNAME="uid=stumv,ou=Services,dc=stumv,dc=de"
+LDAP_PASSWORD=stumv-not-production
+LDAP_BASE_DN="dc=stumv,dc=de"
+LDAP_TIMEOUT=5
+LDAP_SSL=false
+LDAP_TLS=false
+
+CACHE_DRIVER=array
+SESSION_DRIVER=array
+QUEUE_CONNECTION=sync
+MAIL_MAILER=array
+BCRYPT_ROUNDS=4

.github/workflows/analysis.yml

@@ -0,0 +1,42 @@
+name: Analysis
+
+on: push
+
+jobs:
+  analysis:
+    if: false # disable for now
+    name: PHPStan (larastan)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          extensions: ldap, gd, pdo_mysql, zip, mbstring, intl, bcmath, curl
+          coverage: none
+
+      - name: Prepare the environment
+        # larastan boots the application, which needs an APP_KEY and valid config.
+        run: cp .env.testing .env
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Setup composer cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install composer dependencies
+        env:
+          COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH }}
+        run: composer install --no-ansi --no-interaction --no-scripts --prefer-dist --no-progress
+
+      - name: Run PHPStan
+        run: ./vendor/bin/phpstan --error-format=github --memory-limit=1G

.github/workflows/lint.yml

@@ -0,0 +1,39 @@
+name: Lint
+
+on: push
+
+jobs:
+  lint:
+    name: Pint (code style)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          extensions: ldap, gd, pdo_mysql, zip, mbstring, intl, bcmath, curl
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Setup composer cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install composer dependencies
+        # COMPOSER_AUTH carries the credentials for the commercial
+        # livewire/flux-pro package (add it as a repository secret).
+        env:
+          COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH }}
+        run: composer install --no-ansi --no-interaction --no-scripts --prefer-dist --no-progress
+
+      - name: Check code style
+        run: vendor/bin/pint --test

.github/workflows/rector.yml

@@ -0,0 +1,46 @@
+name: Rector
+
+on: push
+
+jobs:
+  rector:
+    name: Rector (dry-run)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          extensions: ldap, gd, pdo_mysql, zip, mbstring, intl, bcmath, curl
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Setup composer cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install composer dependencies
+        env:
+          COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH }}
+        run: composer install --no-ansi --no-interaction --no-scripts --prefer-dist --no-progress
+
+      - name: Rector cache
+        uses: actions/cache@v4
+        with:
+          path: /tmp/rector
+          key: ${{ runner.os }}-rector-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-rector-
+
+      - run: mkdir -p /tmp/rector
+
+      - name: Rector dry-run
+        run: vendor/bin/rector process --dry-run --config=rector.php

.github/workflows/testing.yml

@@ -0,0 +1,107 @@
+name: Testing
+
+on: push
+
+jobs:
+  tests:
+    name: Pest (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # composer.lock resolves to symfony ^8.1 which requires php >= 8.4.1.
+        php: ['8.4']
+
+    services:
+      # MariaDB for the Eloquent side (RefreshDatabase migrates stumv_testing).
+      mariadb:
+        image: mariadb:11
+        env:
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: "yes"
+          MARIADB_DATABASE: stumv_testing
+          MARIADB_USER: stumv
+          MARIADB_PASSWORD: local_stumv_password
+        ports:
+          - 13306:3306
+        options: >-
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # Prod-faithful OpenLDAP (same Symas build as production). Built and run
+      # here rather than as a `services:` entry because it is a local image.
+      # Tests hit it on 127.0.0.1:13389 (matches .env.testing).
+      - name: Build & start LDAP
+        run: |
+          docker build -t stumv-openldap ./docker/openldap
+          docker run -d --name ldap -p 13389:1389 stumv-openldap
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: ldap, gd, pdo_mysql, zip, mbstring, intl, bcmath, curl
+          coverage: none
+
+      - name: Prepare environment file
+        run: cp .env.testing .env
+
+      - name: Get Composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Composer packages
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-
+
+      - name: Install PHP dependencies
+        # COMPOSER_AUTH carries the credentials for the commercial livewire/flux-pro
+        # package. Add a repository secret named COMPOSER_AUTH containing JSON, e.g.
+        # {"http-basic":{"composer.fluxui.dev":{"username":"<email>","password":"<license-key>"}}}
+        env:
+          COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH }}
+        run: composer install --no-ansi --no-interaction --no-scripts --prefer-dist --no-progress
+
+      - name: Generate Passport encryption keys
+        run: php artisan passport:keys
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+
+      - name: Build front-end assets
+        # Produces public/build/manifest.json so @vite resolves in full-page
+        # (HTTP) tests. public/hot is gitignored and absent in CI.
+        run: |
+          npm ci
+          npm run build
+
+      - name: Wait for LDAP to accept binds
+        run: |
+          for i in $(seq 1 30); do
+            if docker exec ldap /opt/symas/bin/ldapwhoami -x \
+                 -H ldap://127.0.0.1:1389 \
+                 -D "uid=stumv,ou=Services,dc=stumv,dc=de" \
+                 -w stumv-not-production >/dev/null 2>&1; then
+              echo "LDAP is up"; exit 0
+            fi
+            echo "waiting for LDAP ($i)..."; sleep 2
+          done
+          echo "LDAP did not come up"; docker logs ldap; exit 1
+
+      - name: Run tests
+        run: ./vendor/bin/pest --no-coverage
+
+      - name: LDAP logs on failure
+        if: failure()
+        run: docker logs ldap || true