Merge pull request 'fix: remove obsolete jcabillot/phpapache references' (#23) from fix/remove-phpapache-renovate into master

Reviewed-on: #23

.gitea/workflows/cron.yaml

@@ -30,7 +30,7 @@ jobs:
         with:
           fetch-depth: 0
       - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2df7f5ca915bee # v4
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -44,7 +44,7 @@ jobs:
           images: jcabillot/ip
           tags: |
             type=raw,value=${{ steps.get-latest-tag.outputs.tag }}-latest,enable=${{ steps.get-latest-tag.outputs.tag != '' }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d7f5c8f03e5195baf # v7.2.0
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: true

.gitea/workflows/tag.yaml

@@ -28,7 +28,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2df7f5ca915bee # v4
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -39,7 +39,7 @@ jobs:
           tags: |
             type=ref,event=tag
             type=ref,event=tag,suffix=-latest
-      - uses: docker/build-push-action@f9f3042f7e2789586610d7f5c8f03e5195baf # v7.2.0
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: true

AGENTS.md

@@ -6,18 +6,19 @@ Lightweight PHP micro-service that returns the client's public IP address as JSO
 
 ## 2. Folder Structure
 
-- `root/`: Application source code served by Apache.
+- `root/`: Application source code served by FrankenPHP/Caddy.
     - `index.php`: Single endpoint returning `REMOTE_ADDR` as JSON.
+- `Caddyfile`: FrankenPHP/Caddy web server configuration — PHP handler on `:8080` with `try_files` + `php_server`.
 - `.gitea/workflows/`: Gitea Actions CI pipelines.
     - `docker-build.yaml`: Build and push Docker image to Docker Hub on push/PR to master + daily cron.
-- `Dockerfile`: Multi-stage build extending `jcabillot/phpapache` base image, copies `root/` into `/var/www/html`.
+- `Dockerfile`: Single-stage build from `dunglas/frankenphp:1-php8.5-alpine`, copies `root/` into `/app/public`.
 - `.gitlab-ci.yml`: Legacy GitLab CI config (deprecated, replaced by Gitea Actions).
 - `Jenkinsfile`: Legacy Jenkins pipeline (deprecated, replaced by Gitea Actions).
 
 ## 3. Core Behaviors & Patterns
 
 - **Request/Response Flow**: Single PHP endpoint sets `Content-Type: application/json` header and returns `$_SERVER['REMOTE_ADDR']` encoded as JSON string. No routing, no framework, no state.
-- **Container Base Image Pattern**: `Dockerfile` uses `ARG VERSION="latest"` to allow version pinning at build time, extends `jcabillot/phpapache` which provides PHP + Apache pre-configured. Application code is layered on top via `COPY root /var/www/html`.
+- **Container Base Image Pattern**: `Dockerfile` is a single-stage build from a fixed `dunglas/frankenphp:1-php8.5-alpine` tag (Alpine-based FrankenPHP with Caddy). No `ARG VERSION` — the tag is pinned, Renovate auto-detects it. Application code is layered via `COPY root /app/public`. FrankenPHP provides PHP + Caddy pre-configured.
 - **Traefik IngressRoute with HTTPS Redirect**: Two IngressRoute resources handle traffic — `ip-websecure` serves HTTPS on the `websecure` entrypoint, `ip-web` catches HTTP on `web` entrypoint and applies a `redirectScheme` middleware for permanent HTTPS redirect. The Service reference in the HTTP IngressRoute is required by Traefik even though the middleware intercepts before reaching it.
 - **Health Probes**: Deployment defines both `livenessProbe` and `readinessProbe` using `httpGet` on `/` at the named `http` port (8080). Kubernetes uses these to restart unhealthy pods and exclude unready pods from the Service endpoints.
 - **Security Hardening**: Pod spec sets `automountServiceAccountToken: false` to prevent unnecessary Kubernetes API access from the container.

Caddyfile

@@ -0,0 +1,11 @@
+{
+    auto_https off
+    frankenphp
+}
+
+:8080 {
+    root * /app/public
+    encode zstd br gzip
+    try_files {path} /index.php?{query}
+    php_server
+}

Dockerfile

@@ -1,5 +1,9 @@
-ARG  VERSION="latest"
+FROM dunglas/frankenphp:1-php8.5-alpine
-FROM "jcabillot/phpapache:${VERSION}"
 LABEL maintainer="Julien Cabillot <dockerimages@cabillot.eu>"
 
-COPY "root" "/var/www/html"
+WORKDIR /app
+
+COPY Caddyfile /etc/frankenphp/Caddyfile
+COPY --chown=www-data:www-data root /app/public
+
+USER www-data

renovate.json

@@ -1,17 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "customManagers": [
-    {
-      "customType": "regex",
-      "description": "Detect ARG VERSION pin for jcabillot/phpapache base image",
-      "managerFilePatterns": [
-        "/^Dockerfile$/"
-      ],
-      "matchStrings": [
-        "ARG\\s+VERSION=\"(?<currentValue>[^\"]+)\""
-      ],
-      "depNameTemplate": "jcabillot/phpapache",
-      "datasourceTemplate": "docker"
-    }
-  ]
-}