PHRAS-4119 release 4.1.13 (#4573)

* bump phraseanet version , change on .env

* PHRAS-4118 remove .htaccess from docker stack

* version changelog

.dockerignore

@@ -36,4 +36,5 @@
 /www/custom
 /www/plugins
 /www/thumbnails
+/www/.htaccess
 npm-debug.log

.env

@@ -13,7 +13,7 @@
 # https://docs.phraseanet.com/4.1/en/Admin/EnvironnementVariables.html
 
 
-# --- ATTENTION POINTS FOR PHRASEANET CONFIGURATION ----------------------------
+# --- ATTENTION POINTS FOR PHRASEANET CONFIGURATION -------------------------------------------------------------------
 # 1. Default Passwords: Ensure all default passwords defined in this configuration are changed to secure, personalized passwords before deployment.
 # 2. MariaDB Container: The provided MariaDB container is not ready for production as-is and requires adjustments. It is recommended to use an external, redundant service for the primary datastore.
 # 3. Configuration Persistence: Changes made in this file need appropriate backups as they are crucial for system restoration and disaster recovery.
@@ -52,9 +52,9 @@
 # - "app"             : launch Phraseanet and Workers.
 # - "setup"           : launch a Phraseanet installation and configuration container, this container is launched to perform a default installation and
 #                       each time it is necessary to update the Phraseanet configuration using the env variables.
-#                       when an update is performed, the current 'config' repository is backuped in 
-# - "gateway-classic" : launch nginx service.
-# - "gateway-traefik" : nginx is launched behind a traefik service, at this time `traefik` is not include in this stack but you can use your own
+#                       when an update is performed, the current phraseanet 'config/' repository is backuped in  
+# - "gateway-classic" : launch Nginx service.
+# - "gateway-traefik" : Nginx is launched behind a traefik service, at this time `traefik` is not include in this stack but you can use your own
 #                       or use `Traefik` include in Phrasea Stack.
 # - "workers"         : launch one worker container by kind of Jobs, you can also
 #                       choose to launch only some workers, see worker profile list below.
@@ -147,14 +147,14 @@ COMPOSE_PROFILES=app,setup,gateway-classic,db,elasticsearch,rabbitmq,redis,redis
 # Registry from which you pull docker images.
 # Avalaible values:
 # - "local"     : build and use your images.
-# - "alchemyfr" : using predbuild images from Alchemy registry.
+# - "alchemyfr" : using predbuild images from Alchemy registry from dockerhub.
 #
 # @run
-PHRASEANET_DOCKER_REGISTRY=local
+PHRASEANET_DOCKER_REGISTRY=alchemyfr
 
 # Docker images tag.
 # @run
-PHRASEANET_DOCKER_TAG=4.1.12
+PHRASEANET_DOCKER_TAG=4.1.13
 
 # Stack Name
 # An optionnal Name for the stack
@@ -242,7 +242,7 @@ PHRASEANET_SETUP=1
 PHRASEANET_UPGRADE=0
 
 # Maintenance mode
-# show an nginx unavailability message
+# show an Nginx unavailability message
 # Available values: "0" | "1" 
 # 0 - for no maintenance mode
 # 1 - for persisting maintenance mode 
@@ -278,23 +278,24 @@ RABBITMQ_MANAGEMENT_PORT=10811
 # @run
 RABBITMQ_HOSTNAME=rabbit_phraseanet
 
-# --- Gateway settings (NGINX) -----------------------------------------------------------------------------------------
+# --- Gateway settings (Nginx) -----------------------------------------------------------------------------------------
 
 # Value applied to "send_timeout", "keepalive_timeout", "client_header_timeout"
-# and "client_body_timeout" nginx settings.
+# and "client_body_timeout" Nginx settings.
 # @run
 GATEWAY_SEND_TIMEOUT=120
 
 # Timeout for establishing a connection with a proxied server. See [documentation|
-# http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout].
+# https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout].
 # @run
 GATEWAY_PROXY_TIMEOUT=120
 
 # Value applied to "fastcgi_connect_timeout", "fastcgi_read_timeout"
-# and "fastcgi_send_timeout" nginx settings.
+# and "fastcgi_send_timeout" Nginx settings.
 # @run
 GATEWAY_FASTCGI_TIMEOUT=300
 
+# --- Gateway restricted access settings (Nginx) -----------------------------------------------------------------------------------------
 # Activate application access restrictions.
 # Restrictions can be based on IP and/or password. Use these settings to control who can access the application.
 
@@ -318,7 +319,7 @@ GATEWAY_USERS=
 # @run
 GATEWAY_STATUS_ALLOWED_IPS=
 
-# HTTP requests quota management.
+# --- Gateway HTTP requests quota management (Nginx) -----------------------------------------------------------------------------------------
 # Manage http incoming request limits by verbs using the "ngx_http_limit_req_module" module.
 # this feature is based on ip adresses and need PHRASEANET_TRUSTED_PROXIES defined to get real_ip
 # READ is for GET and HEAD requests
@@ -327,11 +328,11 @@ GATEWAY_STATUS_ALLOWED_IPS=
 # @run
 HTTP_REQUEST_LIMITS=false
 
-# (m) For Exemple 16,000 IP addresses takes 1 megabyte, so our zone can store about 160,000 addresses.
+# In megabyte For Exemple 16,000 IP addresses takes 1 megabyte, so our zone can store about 160,000 addresses.
 # @run
 HTTP_READ_REQUEST_LIMIT_MEMORY=10
 
-# (r/s) Sets the maximum request rate. By default here the rate cannot exceed 10 requests per second
+# request/seconde, sets the maximum request rate. By default here the rate cannot exceed 100 requests per second
 # @run
 HTTP_READ_REQUEST_LIMIT_RATE=100
 
@@ -351,16 +352,19 @@ HTTP_WRITE_REQUEST_LIMIT_RATE=100
 # @run
 HTTP_WRITE_REQUEST_LIMIT_BURST=20
 
+# --- Gateway HTTPS settings (Nginx) ------------------------------------------------------------------------------------
 # https and reverse proxy (on/off)
 # set to on in the case : https behind a proxy
 # @run
 GATEWAY_FASTCGI_HTTPS=off
 
+# --- Gateway CSP settings (Nginx) --------------------------------------------------------------------------------------
 # Content Security Policy (CSP)
 # helps to detect and mitigate some types of attacks, including Cross-Site Scripting (XSS).
 # CSP default values are included in the "Gateway" container entrypoint.
-# Use GATEWAY_CSP env var if you want to define yours and/or override Gateway CSP values.
-# GATEWAY_CSP="default-src 'self' 127.0.0.1 https://sockjs-eu.pusher.com:443 wss://ws-eu.pusher.com https://apiws.carrick-skills.com:8443 https://apiws.carrick-flow.com:8443 https://fonts.gstatic.com *.tiles.mapbox.com https://api.mapbox.com https://events.mapbox.com *.axept.io *.matomo.cloud *.newrelic.com *.nr-data.net https://www.googletagmanager.com *.google-analytics.com *.phrasea.io https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com data: ; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://www.gstatic.com *.alchemyasp.com *.axept.io *.matomo.cloud *.newrelic.com https://www.googletagmanager.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com  data: blob: ; style-src 'self' 'unsafe-inline' https://fonts.gstatic.com https://fonts.googleapis.com https://www.google.com https://www.gstatic.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com ; img-src 'self'  data: blob: *.tiles.mapbox.com https://axeptio.imgix.net *.cloudfront.net *.phrasea.io *.amazonaws.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com https://www.gnu.org/graphics/ ; object-src 'self'; frame-ancestors 'self'"
+# Use GATEWAY_CSP env var if you want to define yours or override Gateway default CSP values.
+
+# default value GATEWAY_CSP="default-src 'self' 127.0.0.1 https://sockjs-eu.pusher.com:443 wss://ws-eu.pusher.com https://apiws.carrick-skills.com:8443 https://apiws.carrick-flow.com:8443 https://fonts.gstatic.com *.tiles.mapbox.com https://api.mapbox.com https://events.mapbox.com *.axept.io *.matomo.cloud *.newrelic.com *.nr-data.net https://www.googletagmanager.com *.google-analytics.com *.phrasea.io https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com data: ; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://www.gstatic.com *.alchemyasp.com *.axept.io *.matomo.cloud *.newrelic.com https://www.googletagmanager.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com  data: blob: ; style-src 'self' 'unsafe-inline' https://fonts.gstatic.com https://fonts.googleapis.com https://www.google.com https://www.gstatic.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com ; img-src 'self'  data: blob: *.tiles.mapbox.com https://axeptio.imgix.net *.cloudfront.net *.phrasea.io *.amazonaws.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com https://www.gnu.org/graphics/ ; object-src 'self'; frame-ancestors 'self'"
 # @run
 GATEWAY_CSP=
 
@@ -519,6 +523,8 @@ MYSQL_QUERY_CACHE_SIZE=64M
 MYSQL_KEY_BUFFER_SIZE=128M
 
 # --- DB Backup settings ---------------------------------------------------------------------------------------------
+# "db-backup"  profile launch and run a container to cron database backups and backup file's rotation.
+# This container is based on the "alpine" image and use the "mysql-client" package to perform backups. 
 
 # Path where the backuped files will be locally stored
 # @run
@@ -732,14 +738,7 @@ PHRASEANET_AVAILABLE_LANGUAGE=de,en,fr,nl
 # @run
 PHRASEANET_DEFAULT_LANGUAGE=en
 
-
-
-# --- Phraseanet Binaries Execution Timeouts Settings ---
-# These settings define the maximum allowed execution time  for various media processing tools used by Phraseanet.
-# If a process exceeds the specified timeout, it will be considered as having encountered an error.
-# This ensures that system resources are not indefinitely tied up by processes that have stalled or are taking too long to complete.
-
-# --- Phraseanet Binaries Execution Timeouts Settings ---
+# --- Phraseanet Binaries Execution Timeouts Settings -------------------------------------------------------------------
 # These settings define the maximum allowed execution time in minutes for various media processing tools used by Phraseanet.
 # If a process exceeds the specified timeout, it will be considered as having encountered an error.
 # These timeouts should be adjusted based on the file sizes being processed.
@@ -967,36 +966,42 @@ PHRASEANET_EXPLODE_WORKER=1
 #
 # Note for old Phraseanet task planner AKA "Phraseanet scheduler": To launch the
 # "scheduler" container, add "scheduler" profile to "COMPOSE_PROFILES" env
-# var. Launch this container only if you need to use the old Phraseanet tasks.
+# variable.
+# Launch this container only if you need to use the old Phraseanet Archive tasks.
 # @run
 PHRASEANET_WORKERS_LAUNCH_METHOD=
 
+# --- Phraseanet Worker Settings ----------------------------------------------------------------------------------------
+# Define the number of parallel processes launched in a worker container.
+# Prefer scaling the number of containers over the number of processes within a container.
+# this default setting is for a test platform, for production, adjust the number of workers based on the expected workload and to your infrastructure capacity.
+
 # @run
 PHRASEANET_WORKER_assetsIngest=1
 
 # @run
-PHRASEANET_WORKER_createRecord=2
+PHRASEANET_WORKER_createRecord=1
 
 # @run
-PHRASEANET_WORKER_deleteRecord=2
+PHRASEANET_WORKER_deleteRecord=1
 
 # @run
-PHRASEANET_WORKER_editRecord=2
+PHRASEANET_WORKER_editRecord=1
 
 # @run
-PHRASEANET_WORKER_exportMail=2
+PHRASEANET_WORKER_exportMail=1
 
 # @run
-PHRASEANET_WORKER_downloadAsync=2
+PHRASEANET_WORKER_downloadAsync=1
 
 # @run
-PHRASEANET_WORKER_exposeUpload=2
+PHRASEANET_WORKER_exposeUpload=1
 
 # @run
 PHRASEANET_WORKER_ftp=1
 
 # @run
-PHRASEANET_WORKER_mainQueue=3
+PHRASEANET_WORKER_mainQueue=1
 
 # @run
 PHRASEANET_WORKER_populateIndex=1
@@ -1026,8 +1031,9 @@ PHRASEANET_WORKER_writeMetadatas=1
 PHRASEANET_WORKER_shareBasket=1
 
 # PHRASEANET_CMD_MODE=1, set a worker container for run bin/console... or bin/maintenance... manualy
+# Add "cmd" profile to COMPOSE_PROFILE 
 # @run
-PHRASEANET_CMD_MODE
+PHRASEANET_CMD_MODE=1
 
 # --- Phraseanet Locales settings --------------------------------------------------------------------------------------
 
@@ -1119,7 +1125,9 @@ PHRASEANET_CAPTION_DIR=./tmp/caption
 # @run
 PHRASEANET_WORKER_TMP=./tmp/worker
 
-# Backup Directory: Location for storing backup files.
+# Backup Directory: Location for backup Phraseanet 'config/' repository.
+# the backup is perfomed by 'setup' container before performing an update
+# Executed 
 # @run
 PHRASEANET_BACKUP_DIR=./backup
 
@@ -1193,7 +1201,7 @@ NEWRELIC_APP_NAME=
 # --- SAML Authentication Settings --------------------------------------------------------------------------------------
 # Configure settings for SAML (Security Assertion Markup Language) authentication within Phraseanet to enable secure single sign-on (SSO) capabilities.
 # Note: This setup requires an additional paid plugin that is not included in the public images. 
-# It also requires extra containers that must be declared in the Docker compose stack by adding 'phraseanet-saml-sp' to COMPOSE_PROFILE.
+# It also requires extra containers that must be declared in the Docker compose stack by adding 'phraseanet-saml-sp' to COMPOSE_PROFILES.
 
 # Allow Debug: Enables detailed logging for SAML operations. Useful for troubleshooting during setup and testing.
 # @run
@@ -1267,7 +1275,7 @@ PHRASEANET_FTP_DIR=./datas/ftp
 # @run
 SSH_AUTH_SOCK=/dev/null
 
-# Kubernet context needs full pod hosname on nginx reverse proxing 
+# Kubernet context needs full pod hosname on Nginx reverse proxing 
 # This is need for PHraseanet  SAML context on K8S
 # @run
 PHRASEANET_K8S_NAMESPACE=

.gitignore

@@ -97,7 +97,4 @@ myvalues.yaml
 
 
 # Exclude gitlog files
-www/gitlog.txt
-
-
-
+www/gitlog.txt

CHANGELOG.md

@@ -1,5 +1,29 @@
 # CHANGELOG
 
+## 4.1.13
+
+### Update Instructions
+
+- **Migration Patch**:
+  - A migration script for the configuration file is available. Run the following command in the setup container with Docker if the environment variable `PHRASEANET_UPGRADE=1` is set:
+    ```
+    bin/setup system:upgrade
+    ```
+
+### Version Summary
+  - `.env` documentation improvements.
+  - Remove www/.htacess from docker stack.
+  - Remove Nginx access status.
+
+## What's Changed
+* PHRAS-4117 remove gateway /status and /ping page direct access by @moctardiouf in https://github.com/alchemy-fr/Phraseanet/pull/4571
+* PHRAS-4119 exclude www/.htaccess file form docker stack in https://github.com/alchemy-fr/Phraseanet/pull/4573
+
+
+**Full Changelog**: https://github.com/alchemy-fr/Phraseanet/compare/4.1.12...4.1.13
+
+
+__
 ## 4.1.12
 
 ### Update Instructions
@@ -11,7 +35,7 @@
     ```
 
 ### Version Summary
-  - Base image bump for Video encoding fix and newrelic agent installation.
+  - Base image bump for Video encoding fix and newrelic agent installation
   - take in account default language setup in configuration.
   - `.env`file documentation improvement.
 

lib/Alchemy/Phrasea/Core/Version.php

@@ -17,7 +17,7 @@ class Version
      * @var string
      */
 
-    private $number = '4.1.12';
+    private $number = '4.1.13';
 
     /**
      * @var string