ci: fix initial-push CI failures (yamllint + backup image pull) (#5)

* ci(lint): fix yamllint braces/colons + comment indentation

_build-cell.yml workflow_call.inputs used aligned inline mappings (spaces inside
braces / after colons / after commas) that fail yamllint's default rules; collapse
to single-space form. Reorder the commented cadvisor depends_on note so the comment
is followed by same-indent content (comments-indentation). Verified clean against
the exact CI yamllint config + actionlint.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

* fix(backup): make phpbu backup an opt-in profile; decouple scheduler

The ghcr.io/netresearch/phpbu-docker image is currently unpullable upstream
(all tags resolve to GC'd manifests), which broke `docker compose up` for the
whole stack. Move the backup service behind a `backup` compose profile so the
default stack (and smoke-test) comes up without it, and remove backup from the
scheduler's depends_on so the cron/heartbeat — which the app healthcheck rides
on — never hinges on the backup image. Pin the tag to :6. Add `make backup-up`
and document the opt-in. Verified: default stack serves GLPI, app+web healthy.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

* ci(smoke-test): poll for app+web healthy instead of one-shot check

web depends_on app:service_healthy, so it starts only after the ~2-3 min GLPI
install and is freshly-started (Up <1s) when the serve-check passes — its docker
healthcheck (start_period 20s + interval 30s) hasn't reported healthy yet. The
one-shot assert raced that and failed despite the stack serving correctly. Poll
up to 120s for both to report healthy.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

* ci: re-trigger PR checks (prior commit touched only a workflow file)

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

---------

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

Author: CybotTM

.github/workflows/_build-cell.yml

@@ -14,17 +14,17 @@ name: _build-cell
 on:
   workflow_call:
     inputs:
-      version:       { type: string,  required: true }
-      major:         { type: string,  required: true }
-      major_minor:   { type: string,  required: true }
-      glpi_sha256:   { type: string,  required: true }
-      build_date:    { type: string,  required: true }
-      date_tag:      { type: string,  required: true }
-      registry:      { type: string,  required: true }
-      image_name:    { type: string,  required: true }
-      is_main_ref:           { type: boolean, required: true }
-      is_release_from_file:  { type: boolean, required: true }
-      push_artifacts:        { type: boolean, required: true }
+      version: {type: string, required: true}
+      major: {type: string, required: true}
+      major_minor: {type: string, required: true}
+      glpi_sha256: {type: string, required: true}
+      build_date: {type: string, required: true}
+      date_tag: {type: string, required: true}
+      registry: {type: string, required: true}
+      image_name: {type: string, required: true}
+      is_main_ref: {type: boolean, required: true}
+      is_release_from_file: {type: boolean, required: true}
+      push_artifacts: {type: boolean, required: true}
 
 permissions:
   contents: read

.github/workflows/smoke-test.yml

@@ -134,21 +134,30 @@ jobs:
       - name: Assert app + web report healthy
         run: |
           set -eu
-          docker compose ps
-          rc=0
-          for svc in app web; do
-            cid=$(docker compose ps -q "$svc")
-            if [ -z "$cid" ]; then
-              echo "::error::no container found for service $svc"; rc=1; continue
+          # web depends_on `app: service_healthy`, so it only starts once app is
+          # healthy (~2-3 min into the GLPI install). web is then functional —
+          # the serve-check above already proved it — but its docker healthcheck
+          # (start_period 20s + interval 30s) needs a cycle to flip to "healthy".
+          # Poll for up to 120s instead of checking once.
+          deadline=$(( $(date +%s) + 120 ))
+          while :; do
+            docker compose ps
+            rc=0
+            for svc in app web; do
+              cid=$(docker compose ps -q "$svc")
+              if [ -z "$cid" ]; then echo "$svc: no container yet"; rc=1; continue; fi
+              health=$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$cid")
+              echo "$svc: $health"
+              [ "$health" = "healthy" ] || rc=1
+            done
+            [ "$rc" -eq 0 ] && { echo "app + web report healthy"; break; }
+            if [ "$(date +%s)" -ge "$deadline" ]; then
+              echo "::error::app/web did not become healthy within 120s"
+              docker compose logs --tail=200
+              exit 1
             fi
-            health=$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$cid")
-            echo "$svc: $health"
-            [ "$health" = "healthy" ] || { echo "::error::$svc is not healthy ($health)"; rc=1; }
+            sleep 6
           done
-          if [ "$rc" -ne 0 ]; then
-            docker compose logs --tail=200
-            exit 1
-          fi
 
       - name: Tear down (cleanup)
         if: always()

Makefile

@@ -76,8 +76,11 @@ disable-observability: .env ## Remove observability overlay
 # Backup / restore
 # ────────────────────────────────────────────────────────────────────
 
-backup: ## Run a backup now (normally scheduled by ofelia at 03:00)
-	docker compose exec -T backup phpbu --configuration=/config/backup.json
+backup-up: .env ## Start the opt-in backup service (phpbu, behind the `backup` profile)
+	docker compose --profile backup up -d backup
+
+backup: ## Run a backup now (requires `make backup-up`; normally ofelia at 03:00)
+	docker compose --profile backup exec -T backup phpbu --configuration=/config/backup.json
 
 backup-list: ## List backup archives
 	docker compose exec -T backup ls -lh /backups
@@ -201,7 +204,7 @@ clean: ## DESTRUCTIVE: down + delete ALL volumes (db + uploads + backups)
 
 .PHONY: \
 	help init up down restart logs logs-app ps \
-	backup backup-list backup-verify \
+	backup backup-up backup-list backup-verify \
 	health test test-image test-bats hardening-check \
 	dev build lint pull upgrade \
 	shell console restore clean \

README.md

@@ -51,7 +51,7 @@ The official `glpi/glpi` image is Apache + mod_php in a single container with a
 | `app` | `ghcr.io/netresearch/glpi-php-fpm` | GLPI on php-fpm, socket-only, non-root |
 | `web` | `nginx:alpine` | serves `public/` + FastCGI to `app`, CSP/security headers |
 | `scheduler` | `ghcr.io/netresearch/ofelia` | runs GLPI `front/cron.php` (2 min) + phpbu (nightly) |
-| `backup` | `ghcr.io/netresearch/phpbu-docker` | nightly DB dump + `files/` + **config (crypt key)** archive |
+| `backup` _(opt-in: `--profile backup`)_ | `ghcr.io/netresearch/phpbu-docker` | nightly DB dump + `files/` + **config (crypt key)** archive |
 
 ## Quickstart
 
@@ -133,7 +133,7 @@ make down                 # stop (keep volumes)
   **CLI** mode (Setup → General → Automatic actions) for deterministic scheduling.
 - **Upgrades** — bump `.glpi-version` (+ `GLPI_IMAGE_TAG`), `make up`; the
   entrypoint runs a maintenance-wrapped `database:update`.
-- **Backups / restore** — see [`docs/runbook-restore.md`](docs/runbook-restore.md).
+- **Backups / restore** — see [`docs/runbook-restore.md`](docs/runbook-restore.md). The `backup` service (phpbu) is **opt-in** behind the `backup` compose profile — start it with `make backup-up` (or `docker compose --profile backup up -d`).
 - **Day-2 ops** — see [`docs/runbook-day2-ops.md`](docs/runbook-day2-ops.md).
 - **ofelia is host-wide:** with the docker socket mounted it runs the labelled
   jobs of **every** stack on the host — run only one labelled stack per host, or

compose.yml

@@ -13,6 +13,7 @@
 #   scheduler   — ofelia (Netresearch's fork), label-driven cron for GLPI's
 #                 front/cron.php (every 2 min) and phpbu (nightly)
 #   backup      — phpbu-docker, nightly DB dump + files/config archives
+#                 (opt-in: `--profile backup`)
 #
 # Quickstart:
 #   1. make init            # generates .env with random secrets
@@ -335,8 +336,6 @@ services:
     depends_on:
       app:
         condition: service_started
-      backup:
-        condition: service_started
     command: ["daemon"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -353,9 +352,16 @@ services:
   #
   # For off-host storage, bind-mount ./backups to a NAS/NFS share, or run
   # restic/rclone on the host reading the named volume.
+  #
+  # OPT-IN: behind the `backup` compose profile, so a plain `docker compose
+  # up -d` (and the default `make up`) brings up the working core without it.
+  # Enable with:  docker compose --profile backup up -d   (or `make backup-up`).
+  # This also decouples the default stack from the phpbu-docker image's
+  # availability — pin/replace the tag below for your environment.
   # ---------------------------------------------------------------------
   backup:
-    image: ghcr.io/netresearch/phpbu-docker:latest
+    profiles: ["backup"]
+    image: ghcr.io/netresearch/phpbu-docker:6
     restart: unless-stopped
     mem_limit: 256m
     cpus: 0.5

examples/compose.observability.yml

@@ -212,14 +212,14 @@ services:
         max-size: "10m"
         max-file: "5"
     depends_on:
-      mysqld-exporter:
-        condition: service_started
-      nginx-prometheus-exporter:
-        condition: service_started
       # Uncomment together with the cadvisor service block above to enable
       # container-tier metrics:
       # cadvisor:
       #   condition: service_started
+      mysqld-exporter:
+        condition: service_started
+      nginx-prometheus-exporter:
+        condition: service_started
     command:
       - --config.file=/etc/prometheus/prometheus.yml
       - --storage.tsdb.path=/prometheus