Consider moving composer vendor outside document root

steinmb commented 3 years ago

Composer download and track dependencies between PHP libraries. Used by modules and custom code like the OAIPHM data migrator. We need to make sure the config is tracked by code revision and updating of the libraries only happen in development and no automagically in production potential braking the site.

Write problems: Drupal change due to security reasons the write sites/*/ on each page load. This lead to permissions updating libraries.

Current config

composer.json - cellproject.net/files/composer
vendor - cellproject.net/composer

Suggested fix

[x] Move the libraries (vendor) outside DocumentRoot
[x] Disable: Automatic build the composer.json file and run Composer commands when enabling or disabling modules. These should be never done in a production environment.
[x] Update .gitignore to reflect changes to vendor location.
[x] Make sure we do not mix lib. version in a multisite env. like CELL
[x] Ref. issues like #13 we need to bind our composer config to the same PHP version as production systems run on.
[x] Download and install lib. by running composer bin/site-drush -l cellproject.local composer-execute install --no-dev.
[x] Search and destroy libraries and composer.* left behind by old config.

$site_dir = basename(__DIR__);
$conf['composer_manager_vendor_dir'] = '../lib/' . $site_dir . '/vendor';
$conf['composer_manager_file_dir'] = '../lib/' . $site_dir;

How to test

Deploy to cell.elmcip.net and run composer install --no-dev. No end user testing is required.

steinmb commented 3 years ago

@deheckman - Moving on and start digging into the OAIPHM https://github.com/smbjorklund/cellproject/milestone/4

steinmb commented 3 years ago

3 updates that move this issue forward. Needs to be retested in staging.

commit 668f65fc5aa119076936206e1fc648a7726dd74c (HEAD -> master, origin/master) Author: Stein Magne Bjorklund steinmb@smbjorklund.com Date: Tue Jan 12 17:09:11 2021 +0100

Issue 16 - Do not ignore Guzzle lib from git

We should not need to track these

commit 443d7a40278665f69b92d07d82a99dd3b45b0ac6 Author: Stein Magne Bjorklund steinmb@smbjorklund.com Date: Tue Jan 12 17:06:29 2021 +0100

Issue 16 Remove libraries added by Composer

We move the vendor directory and these files should
not be tracked by git anyway.

commit elmcip/elmcip@f2b2a4136d8505ad81732b82b6853e34dafc8de1 (HEAD -> master, origin/master, origin/HEAD) Author: Stein Magne Bjorklund steinmb@smbjorklund.com Date: Tue Jan 12 17:12:43 2021 +0100

CELL and ELMCIP composer vendor multisite location

- Track composer.* files

steinmb commented 3 years ago

Pushed and tested new config on https://cell.elmcip.net

bin/site-drush -l cell.elmcip.net composer-execute install --no-dev
Loading composer repositories with package information
Installing dependencies from lock file
Package operations: 9 installs, 0 updates, 0 removals
  - Installing caseyamcl/phpoaipmh (v3.3): Downloading (100%)
  - Installing symfony/polyfill-php72 (v1.22.0): Downloading (100%)
  - Installing symfony/polyfill-intl-normalizer (v1.22.0): Downloading (100%)
  - Installing symfony/polyfill-intl-idn (v1.22.0): Downloading (100%)
  - Installing ralouphie/getallheaders (3.0.3): Downloading (100%)
  - Installing psr/http-message (1.0.1): Downloading (100%)
  - Installing guzzlehttp/psr7 (1.7.0): Downloading (100%)
  - Installing guzzlehttp/promises (1.4.0): Downloading (100%)
  - Installing guzzlehttp/guzzle (6.5.5): Downloading (100%)
Generating autoload files

steinmb commented 3 years ago

Set in production. Placed outside documentRoot and disabled automagic updates in Drupal settings. Do want magic changing code since we now are tracking composer.* in git

$conf['composer_manager_autobuild_file'] = 0;
$conf['composer_manager_autobuild_packages'] = 0;

smbjorklund / cellproject