Fix Caddy compose mounts for self-hosted Docker runtime

.github/workflows/code_quality.yml

@@ -9,16 +9,21 @@ on:
 
 jobs:
   qodana:
-    runs-on: ubuntu-latest
+    # Run on our self-hosted runner to avoid GitHub-hosted Actions budget limits.
+    runs-on: [self-hosted, Linux, X64, default]
     permissions:
       contents: write
       pull-requests: write
       checks: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha }}  # to check out the actual pull request commit, not the merge commit
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}  # Use PR head when available, otherwise the pushed SHA.
           fetch-depth: 0  # a full history is required for pull request analysis
+      - name: Prepare Qodana cache directories
+        run: |
+          mkdir -p "${RUNNER_TEMP}/qodana/caches"
+          mkdir -p "${RUNNER_TEMP}/qodana/results"
       - name: 'Qodana Scan'
         uses: JetBrains/qodana-action@v2025.3
         with:

.github/workflows/tests.yml

@@ -22,25 +22,35 @@ jobs:
       - name: Check AI workflow sync
         run: node scripts/sync-ai-workflow.mjs --check
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.2'
-          extensions: mysqli, curl, openssl, json, redis, xdebug
-          coverage: xdebug
-          ini-values: variables_order=EGPCS,xdebug.mode=coverage
+      - name: Materialize compose env files
+        env:
+          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
+          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
+        run: |
+          set -euo pipefail
+          if [ -z "${COMPOSE_ENV}" ]; then
+            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
+            exit 1
+          fi
+          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
+            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
+            exit 1
+          fi
+          printf '%s\n' "$COMPOSE_ENV" > .env
+          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
+
+      - name: Boot php1 test stack
+        run: docker compose up -d redis mysql-debug php1
 
       - name: Resolve dependencies
-        working-directory: services/nginx/app
-        run: composer update --no-interaction --prefer-dist
+        run: docker compose exec -T php1 sh -lc "cd /var/www/html && composer update --no-interaction --prefer-dist"
 
       - name: Run unit tests
-        working-directory: services/nginx/app
-        run: composer test:unit
+        run: docker compose exec -T php1 sh -lc "cd /var/www/html && composer test:unit"
 
       - name: Generate coverage report
-        working-directory: services/nginx/app
-        run: composer test:coverage
+        run: |
+          docker compose exec -T php1 sh -lc "cd /var/www/html && if php -m | grep -Eq '^(pcov|xdebug)$'; then composer test:coverage; else echo 'Skipping coverage: no pcov/xdebug extension available in php1 image.'; fi"
 
       - name: Upload coverage artifact
         if: ${{ github.event_name == 'pull_request' }}
@@ -52,6 +62,10 @@ jobs:
           if-no-files-found: warn
           retention-days: 1
 
+      - name: Tear down php1 test stack
+        if: always()
+        run: docker compose down -v
+
   edge-agent:
     name: Edge Agent (required)
     runs-on: [self-hosted, Linux, X64, default]
@@ -123,6 +137,12 @@ jobs:
   edge-gateway-backend:
     name: Edge Gateway Backend (required)
     runs-on: [self-hosted, Linux, X64, default]
+    env:
+      TRAEFIK_WEB_PORT: "18080"
+      TRAEFIK_WEBSECURE_PORT: "18443"
+      TRAEFIK_WEBSECURE_STAGING_PORT: "18433"
+      TRAEFIK_METRICS_PORT: "19100"
+      EDGE_GATEWAY_E2E_BASE_URL: "http://localhost:18080/api"
 
     steps:
       - name: Checkout
@@ -171,134 +191,75 @@ jobs:
     runs-on: [self-hosted, Linux, X64, default]
     continue-on-error: true
 
-    services:
-      redis:
-        image: redis:7
-        ports:
-          - 6379:6379
-      mysql:
-        image: mysql:8
-        env:
-          MYSQL_DATABASE: app_test
-          MYSQL_ROOT_PASSWORD: root
-        ports:
-          - 3306:3306
-        options: >-
-          --health-cmd="mysqladmin ping -h 127.0.0.1 -proot"
-          --health-interval=10s
-          --health-timeout=5s
-          --health-retries=10
-
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.2'
-          extensions: mysqli, curl, openssl, json, redis
-          ini-values: variables_order=EGPCS
+      - name: Materialize compose env files
+        env:
+          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
+          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
+        run: |
+          set -euo pipefail
+          if [ -z "${COMPOSE_ENV}" ]; then
+            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
+            exit 1
+          fi
+          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
+            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
+            exit 1
+          fi
+          printf '%s\n' "$COMPOSE_ENV" > .env
+          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
+
+      - name: Boot integration stack
+        run: docker compose up -d redis mysql-debug php1
 
       - name: Resolve dependencies
-        working-directory: services/nginx/app
-        run: composer update --no-interaction --prefer-dist
+        run: docker compose exec -T php1 sh -lc "cd /var/www/html && composer update --no-interaction --prefer-dist"
 
       - name: Run integration tests
-        working-directory: services/nginx/app
-        env:
-          RUN_INTEGRATION_TESTS: '1'
-          USE_ENV: 'true'
-          DEBUG: '0'
-          ENCRYPTION_KEY: test-key
-          CORS: '*'
-          CONFIG_TIMEZONE: Europe/Copenhagen
-          ECONOMIC_API_APP_ACCESS_GRANT: test
-          ECONOMIC_API_APP_ACCESS_GRANT2: test
-          ECONOMIC_API_APP_SECRET_TOKEN: test
-          WORDPRESS_STATIC_TOKEN: ''
-          EMAIL_WASH_CERTIFICATE_TOKEN: ''
-          WORDPRESS_API_URL: http://localhost
-          MINIO_ENDPOINT: ''
-          MINIO_ACCESS_KEY: ''
-          MINIO_SECRET_KEY: ''
-          SLACK_DEFAULT_WEBHOOK: ''
-          REDIS_CONFIG_HOST: 127.0.0.1
-          REDIS_CONFIG_DATABASE: '0'
-          REDIS_CONFIG_PASSWORD: ''
-          REDIS_CONFIG_PORT: '6379'
-          CONFIG_DB_HOST: 127.0.0.1
-          CONFIG_DB_USER: root
-          CONFIG_DB_PASSWORD: root
-          CONFIG_DB_DATABASE: app_test
-          CONFIG_DB_PORT: '3306'
-        run: composer test:integration
+        run: docker compose exec -T -e RUN_INTEGRATION_TESTS=1 php1 sh -lc "cd /var/www/html && composer test:integration"
+
+      - name: Tear down integration stack
+        if: always()
+        run: docker compose down -v
 
   api:
     name: API (advisory)
     runs-on: [self-hosted, Linux, X64, default]
     continue-on-error: true
 
-    services:
-      redis:
-        image: redis:7
-        ports:
-          - 6379:6379
-      mysql:
-        image: mysql:8
-        env:
-          MYSQL_DATABASE: app_test
-          MYSQL_ROOT_PASSWORD: root
-        ports:
-          - 3306:3306
-        options: >-
-          --health-cmd="mysqladmin ping -h 127.0.0.1 -proot"
-          --health-interval=10s
-          --health-timeout=5s
-          --health-retries=10
-
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.2'
-          extensions: mysqli, curl, openssl, json, redis
-          ini-values: variables_order=EGPCS
+      - name: Materialize compose env files
+        env:
+          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
+          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
+        run: |
+          set -euo pipefail
+          if [ -z "${COMPOSE_ENV}" ]; then
+            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
+            exit 1
+          fi
+          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
+            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
+            exit 1
+          fi
+          printf '%s\n' "$COMPOSE_ENV" > .env
+          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
+
+      - name: Boot API stack
+        run: docker compose up -d redis mysql-debug php1
 
       - name: Resolve dependencies
-        working-directory: services/nginx/app
-        run: composer update --no-interaction --prefer-dist
+        run: docker compose exec -T php1 sh -lc "cd /var/www/html && composer update --no-interaction --prefer-dist"
 
       - name: Run API tests
-        working-directory: services/nginx/app
-        env:
-          RUN_API_TESTS: '1'
-          API_TEST_BOOTSTRAP_SCHEMA: '1'
-          USE_ENV: 'true'
-          DEBUG: '0'
-          ENCRYPTION_KEY: test-key
-          CORS: '*'
-          CONFIG_TIMEZONE: Europe/Copenhagen
-          ECONOMIC_API_APP_ACCESS_GRANT: test
-          ECONOMIC_API_APP_ACCESS_GRANT2: test
-          ECONOMIC_API_APP_SECRET_TOKEN: test
-          WORDPRESS_STATIC_TOKEN: ''
-          EMAIL_WASH_CERTIFICATE_TOKEN: ''
-          WORDPRESS_API_URL: http://localhost
-          MINIO_ENDPOINT: ''
-          MINIO_ACCESS_KEY: ''
-          MINIO_SECRET_KEY: ''
-          SLACK_DEFAULT_WEBHOOK: ''
-          REDIS_CONFIG_HOST: 127.0.0.1
-          REDIS_CONFIG_DATABASE: '0'
-          REDIS_CONFIG_PASSWORD: ''
-          REDIS_CONFIG_PORT: '6379'
-          CONFIG_DB_HOST: 127.0.0.1
-          CONFIG_DB_USER: root
-          CONFIG_DB_PASSWORD: root
-          CONFIG_DB_DATABASE: app_test
-          CONFIG_DB_PORT: '3306'
-        run: composer test:api
+        run: docker compose exec -T -e RUN_API_TESTS=1 -e API_TEST_BOOTSTRAP_SCHEMA=1 php1 sh -lc "cd /var/www/html && composer test:api"
+
+      - name: Tear down API stack
+        if: always()
+        run: docker compose down -v

docker-compose.yml

@@ -4,11 +4,11 @@ services:
     image: traefik:2.11
     container_name: traefik
     ports:
-      - "80:80"
-      - "443:443"
-      - "4433:4433"
+      - "${TRAEFIK_WEB_PORT:-80}:80"
+      - "${TRAEFIK_WEBSECURE_PORT:-443}:443"
+      - "${TRAEFIK_WEBSECURE_STAGING_PORT:-4433}:4433"
       # Prometheus metrics endpoint (local dev)
-      - "9100:9100"
+      - "${TRAEFIK_METRICS_PORT:-9100}:9100"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./services/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
@@ -143,7 +143,7 @@ services:
       - php5
     volumes:
       - ./services/nginx/app:/var/www/html
-      - ./services/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./services/caddy:/etc/caddy:ro
       - ./services/caddy/logs:/var/log/caddy
     labels:
       - "traefik.enable=true"
@@ -200,9 +200,10 @@ services:
     container_name: caddy-staging
     depends_on:
       - php-staging
+    command: ["caddy", "run", "--config", "/etc/caddy/Caddyfile-staging", "--adapter", "caddyfile"]
     volumes:
       - ./services/nginx/app:/var/www/html
-      - ./services/caddy/Caddyfile-staging:/etc/caddy/Caddyfile:ro
+      - ./services/caddy:/etc/caddy:ro
       - ./services/caddy/logs-staging:/var/log/caddy
     labels:
       - "traefik.enable=true"

services/edge-agent/dist/agent.mjs

@@ -137,6 +137,7 @@ function buildTransportHeartbeatState(brokerState = {}) {
     status: "ONLINE",
     metadata: {
       command_transport: brokerConnected ? "BROKER_FAST_PATH" : "API_POLLING",
+      shell_transport: brokerConnected ? "BROKER_FAST_PATH" : "API_POLLING",
       broker_connected: brokerConnected,
       broker_url: brokerState.url || null,
       broker_last_error: brokerState.lastError || null,
@@ -1764,19 +1765,18 @@ export async function startAgent({
   const commandPollTimeoutSeconds = Number(config.commandPollTimeoutSeconds || 20);
   const commandPollRetryDelayMs = Number(config.commandPollRetryDelayMs || 1000);
   const brokerReconnectDelayMs = Number(config.brokerReconnectDelayMs || DEFAULT_BROKER_RECONNECT_DELAY_MS);
+  const shellActionPollTimeoutSeconds = Number(config.shellActionPollTimeoutSeconds || 20);
+  const shellActionPollRetryDelayMs = Number(config.shellActionPollRetryDelayMs || 1000);
 
   let stopped = false;
   let cpuSnapshot = null;
   let lastHeartbeatLatencyMs = null;
-  void createShellBridgeImpl;
   let brokerBridge = null;
-  const shell = {
-    open: async () => {},
-    input: () => {},
-    resize: () => {},
-    close: () => {},
-    dispose: () => {},
-  };
+  const shellEventPublisher = createShellEventPublisher(config, fetchImpl);
+  const shell = createShellBridgeImpl((message) => {
+    brokerBridge?.send(message);
+    shellEventPublisher.publish(message);
+  });
   brokerBridge = createBrokerBridge({
     config,
     shell,
@@ -1841,8 +1841,32 @@ export async function startAgent({
     }
   };
 
+  const runShellActionPollLoop = async () => {
+    while (!stopped) {
+      try {
+        const action = await pollShellActionJob(config, fetchImpl, shellActionPollTimeoutSeconds);
+        if (stopped) {
+          break;
+        }
+
+        if (!action) {
+          continue;
+        }
+
+        await processPolledShellAction(config, action, shell, fetchImpl);
+      } catch {
+        if (stopped) {
+          break;
+        }
+
+        await new Promise((resolve) => setTimeout(resolve, shellActionPollRetryDelayMs));
+      }
+    }
+  };
+
   await sendTransportHeartbeat();
   const commandPollPromise = runCommandPollLoop();
+  const shellActionPollPromise = runShellActionPollLoop();
 
   const timer = setInterval(() => {
     sendTransportHeartbeat().catch(() => {});
@@ -1853,8 +1877,9 @@ export async function startAgent({
     stopped = true;
     clearInterval(timer);
     brokerBridge?.stop();
+    await shellEventPublisher.drain();
     shell.dispose();
-    await Promise.allSettled([commandPollPromise]);
+    await Promise.allSettled([commandPollPromise, shellActionPollPromise]);
   };
 
   return {