Deliver the full Docker stack for Bloc 5 DevOps (Cr 7.c.3 and 7.c.4):
- docker/apache/ Custom httpd:2.4-alpine with hardened main config,
MPM event tuning and 3 vhosts (healthz, kiosk static,
admin reverse FCGI to wakdo-app:9000). Kiosk vhost
explicitly denies .php to enforce Bloc 1 isolation.
- docker/php-fpm/ Custom php:8.3-fpm-alpine3.20 with pdo_mysql, opcache,
intl, exif, zip and tini for signal handling.
Dynamic pool 3-10 workers listening on TCP 9000.
- docker/cron/ Custom alpine:3.20 with dcron, mariadb-client, gzip.
Nightly mysqldump at 03h00 with 14-day rotation and
512-byte sanity check. Purge and stats jobs templated.
- docker-compose.yml 4 services orchestrated on 2 networks (internal
bridge + external reverse-proxy). 2 named volumes
for DB and uploads, bind-mount for backups.
Traefik labels for 2 routers with HTTPS redirect.
Makefile adds `make backup` (manual dump) and `make backup-ls`.
.gitignore adds /var/ for backup bind-mount path.
docs/journal/2026-04-24--infra-docker.md documents 5 decisions with
alternatives, maps 16 RNCP criteria to artefacts and prepares 6 jury Q&A.
Validated: `docker compose config --quiet` passes. Smoke test deferred
to next session (requires server .env).
.env.example : template neutre (kiosk.example.com / admin.example.com /
traefik_proxy, RFC 2606 pour le domaine), a editer par l'utilisateur.
Variables DB_*, SESSION_*, CORS_*, APP_URL_*, TRAEFIK_DOMAIN_*,
REVERSE_PROXY_NETWORK. Aucune information de prod (FQDN, noms de reseau)
n'est exposee dans ce template committe.
.dockerignore : exclusion du contexte de build des artefacts non
pertinents ou sensibles (git, docs, tests, .claude, _byan, secrets,
node_modules, logs, volumes locaux).
Makefile : orchestration en une seule commande conforme Cr RNCP 7.c.4.
- Charge .env automatiquement avec export vers l'environnement shell
- Cible check-env valide la presence des 8 variables critiques Wakdo
et guide l'utilisateur vers un merge plutot qu'un ecrasement si un
.env pre-existant (tooling externe) est detecte incomplet
- Cible init enchaine .env check -> check-env -> reseau proxy ->
build -> up -> wait-db -> migrate -> status final
- Verification du reseau REVERSE_PROXY_NETWORK avec message d'aide
precis si absent (sans auto-creation silencieuse : l'utilisateur
decide soit d'adapter la variable soit de creer le reseau)
- Cibles secondaires : up / down / stop / restart / build / rebuild,
logs(-app|-web|-db), shell-(app|db|cron), wait-db, migrate, seed,
backup, test(-unit|-integration), lint, clean (interactif),
clean-force (CI), install-hooks. Aide auto-generee via make help.
Les cibles marquees [a venir] seront completees lors des phases
correspondantes (P2 back squelette, P6 tests, P7 DevOps finalisation).
