- Implemented CorsRegexEnvProcessor to build CORS origin regex from a comma-separated host list (ALLOWED_FRONTEND_HOSTS).
- Added tests for CorsRegexEnvProcessor to validate regex generation and matching behavior.
- Created JSON files for AST representation of the new classes and tests.
Coolify-doc-driven production hardening of the deploy stack:
- run the whole stack as non-root www-data; nginx on 8080 (non-privileged),
pid in /tmp, user directive dropped (Coolify routes to any port)
- docker/healthcheck.sh: hit real /health route via PHP (not just port probe)
- split OPcache config into docker/php/opcache.ini
- graceful shutdown: supervisord stopsignal/stopwaitsecs + worker stop_grace_period
- APCu intentionally not added (Symfony cache uses redis)
- DEPLOY.md: 8080 port, non-root, resource-limit guidance
Verified on linux/amd64: non-root uid=82, /health 200, migrations run,
worker process healthcheck OK.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
worker-async crashed in a loop with 'No transport supports Messenger DSN
redis://...' because symfony/redis-messenger was never installed — 10x restart
killed the whole stack. Add the package (v7.4.8).
Also harden healthchecks:
- app: hit the real /health route via PHP get_headers (verifies app boots and
serves, not just that port 80 is open)
- workers: confirm the messenger:consume process is alive via busybox ps
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hamed