[vitormattos]

Problem

Recreating the PHP-FPM app container may change its Docker IP. With a statically resolved upstream, Nginx can keep connecting to the old address and return HTTP 502 until it is reloaded. This affected the Portabilis instance on Ada and can affect the LibreCode instance.

Changes

• Use Docker embedded DNS (127.0.0.11) and dynamic Nginx upstream resolution for app:9000, including a shared zone and bounded DNS refresh/timeout.
• Keep the Trivy security gate strict while refreshing OS packages on every build: no-cache-filters: runtime for the app images and no-cache: true for the small web image. This prevents cached apt/apk upgrades from leaving fixable vulnerabilities in new builds.
• Add a Bats integration test that recreates PHP-FPM at a genuinely different IP and verifies automatic recovery without restarting Nginx. The test fails against the old Nginx configuration.
• Make Bats test discovery automatic by component: tests/ci/, tests/app/, tests/web/, tests/development/ and tests/cli/. The Makefile selects all *.bats files in each category. Adding a test within an existing category requires no Makefile or workflow edits.
• Run the app and web test suites inside the existing build-and-scan composite action, not as standalone single-file workflow steps. Adjust the master-image and NCDD workflows to run the same Makefile targets and use directory-based path filters.
• Convert the existing ad hoc Trivy shell test into four Bats tests automatically included in the offline CI suite.

Validation

• Local: 35 offline Bats tests, 12 NCDD tests, 5 development tests, and the Nginx DNS recovery test pass.
• Tested automatic discovery by adding a temporary second web Bats test: both tests ran through make test-web-image without any change to the Makefile or workflows. The temporary test was removed.
• Affected YAML files parse correctly, Git diffs pass whitespace checks, and commits are GPG-signed with DCO.
• Earlier commit 1d2b7b5 passed the complete stable-image matrix, Trivy, and runtime tests in CI run #157. CI revalidated successfully at commit 43e0a73: stable-image matrix #158 passed for Nextcloud 33/34/35, Nginx/Trivy/Bats and offline scripts; master image #64 passed for AMD64 and ARM64; NCDD CLI #60 passed. Image publication jobs were skipped as intended on pull requests. No production deployment or merge performed.

Scope and rollout

• No static PHP-FPM IP, production deployment or reverse-proxy network changes.
• Nginx upstream resolve requires a compatible Nginx release (observed runtime: 1.31.7).
• The ambiguous web service alias on the shared reverse-proxy network is tracked separately.
• After code review and successful CI, roll out to the LibreCode and Portabilis web containers independently and check application/API routes.