Fresh-account deploy fixes: TF cycle, CI, SPIP public URL, cron, docs - #2
Merged
Conversation
added 7 commits
September 8, 2026 12:14
…t-3)
Found by cloning the repo into a new folder and running the docs step by step
against a clean AWS account:
- Dockerfile: DROP the SpipCles overlay COPY (+ delete the dead overlay file). It
overrode SPIP core's complete class with a partial one missing secret_des_actions(),
which fatals during plugin/queue init. Keys already come from SPIP_CLES via
prepend.php each boot, so the SSM write-back overlay was both redundant and harmful.
- cloudfront.tf: default behavior must use Managed-AllViewerExceptHostHeader (not
AllViewer) — forwarding the viewer Host to the execute-api origin makes API Gateway
return 403. Fixes CloudFront -> 403 with no custom domain.
- bootstrap-db.php: include_spip('inc/texte'/'inc/filtres') before plugin_installes_meta
so typo()/propre() are defined in the CLI context (else Fatal: undefined typo()).
- docs/db-bootstrap.md: fix the container command (was 'php -d ...' after --entrypoint
php => ran 'php php'); now '-d ...'.
- README: expand Prerequisites (Docker running, Terraform >=1.14 not 1.5, AWS CLI v2
active session) and add the 'create the Terraform state bucket' first step.
Verified: static + build + push + assets + app + bootstrap + CloudFront all green;
public site and /spip.php?page=login return 200 through CloudFront.
…tion A) Without a custom domain, CloudFront strips the viewer Host (AllViewerExceptHostHeader, required so API Gateway accepts the request), so SPIP saw the execute-api host and built absolute URLs (login 'converser', redirects, canonical, emails) on the wrong host/without the stage — the login POST 403'd. - prepend.php: pin $_SERVER HTTP_HOST/SERVER_NAME/HTTPS from SPIP_PUBLIC_URL before SPIP boots, so url_de_base() emits the real public host. - app/locals.tf: SPIP_PUBLIC_URL env = https://<custom domain | cloudfront domain>. - bootstrap-db.php: set the adresse_site meta from SPIP_PUBLIC_URL (CLI install can't infer it; was 'http://' → 'http:///' in logo/canonical/email links). - db-bootstrap.md: pass -e SPIP_PUBLIC_URL in the bootstrap run. Verified on the eu-west-3 test stack: no execute-api URLs emitted, adresse_site = the CloudFront URL, http:/// gone.
…p adresse_site on domain change
…pCles.php overlay reference
….en.md) with language switcher
prepend.php disables the queue on web requests (_DEBUG_BLOCK_QUEUE) and expects an external trigger, but cron.tf had been dropped when building the bare repo — so SPIP's scheduled jobs never ran. Re-add the generic rule: EventBridge -> synthetic /spip.php?action=cron event -> Lambda, which is the one path that runs the queue.
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR successfully addresses critical deployment issues discovered during fresh-account testing. The infrastructure fixes resolve the Terraform cycle, correct CloudFront request forwarding, and ensure SPIP generates proper absolute URLs behind the CDN. The EventBridge cron restoration ensures scheduled jobs run reliably.
Key fixes verified:
- Terraform cycle resolved by making
stage_namea constant local - CloudFront origin policy correctly set to
AllViewerExceptHostHeader SPIP_PUBLIC_URLproperly injected intoHTTP_HOSTto fix login/redirects- EventBridge cron rule re-added with correct Lambda invocation
- Bootstrap script sets
adresse_sitemeta and includes missing dependencies
All changes appear correctly implemented for production deployment.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Everything found and fixed by dogfooding the repo on a clean AWS account (eu-west-3), verified live.
ci.yml): fmt/validate + php -l + bash -n + no-push docker build;deploy.ymlskips until an env is configured.secret_des_actions()).AllViewerExceptHostHeader(was 403).SPIP_PUBLIC_URLpinned intoHTTP_HOST(prepend.php) +adresse_sitemeta at bootstrap → SPIP absolute links correct behind CloudFront (login works)./spip.php?action=cron) — was missing so the SPIP queue never ran. Applied + verified on test.Verified end-to-end on eu-west-3: install/schema/admin, login+admin, S3 upload, CloudWatch logs, X-Ray (63 traces), EventBridge cron rule ENABLED.