feat: use PHP 8.5 in Drupal, Symfony and Drupal module templates

CHANGELOG.md

@@ -6,6 +6,9 @@ Changelog", this file is a reverse-chronological list of merged pull requests.
 
 ## Open PR's
 
+- [PR-162](https://github.com/itk-dev/devops_itkdev-docker/pull/162) - 2026-11-02 -
+  Switched the Drupal, Symfony and Drupal module templates to PHP 8.5. The
+  `drupal-10` template stays on PHP 8.4, as Drupal 10 does not support 8.5
 - [PR-159](https://github.com/itk-dev/devops_itkdev-docker/pull/159) - 2026-10-26 -
   Switched the Drupal and Symfony templates to `nginx/nginx-unprivileged`,
   as `nginxinc/nginx-unprivileged` is no longer maintained

templates/drupal-10/docker-compose.server.yml

@@ -0,0 +1,64 @@
+# itk-version: 3.2.4
+networks:
+  frontend:
+    external: true
+  app:
+    driver: bridge
+    internal: false
+
+services:
+  phpfpm:
+    image: itkdev/php8.4-fpm:alpine
+    restart: unless-stopped
+    networks:
+      - app
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    environment:
+      - PHP_MAX_EXECUTION_TIME=30
+      - PHP_MEMORY_LIMIT=128M
+      # Let drush know the site uri (makes using --uri redundant)
+      - DRUSH_OPTIONS_URI=https://${COMPOSE_SERVER_DOMAIN:?}
+    depends_on:
+      - memcached
+    volumes:
+      - .:/app
+
+  nginx:
+    image: nginx/nginx-unprivileged:alpine
+    restart: unless-stopped
+    networks:
+      - app
+      - frontend
+    depends_on:
+      - phpfpm
+    volumes:
+      - ./.docker/templates:/etc/nginx/templates:ro
+      - ./.docker/nginx.conf:/etc/nginx/nginx.conf:ro
+      - .:/app
+    environment:
+      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME:?}-phpfpm-1:9000
+      NGINX_CRON_METRICS: ${COMPOSE_PROJECT_NAME:?}-phpfpm-1:9746
+      NGINX_WEB_ROOT: /app/web
+      NGINX_PORT: 8080
+      NGINX_MAX_BODY_SIZE: 5M
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=frontend"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-http.rule=Host(`${COMPOSE_SERVER_DOMAIN:?}`)"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-http.entrypoints=web"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-http.middlewares=redirect-to-https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}.rule=Host(`${COMPOSE_SERVER_DOMAIN:?}`)"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}.entrypoints=websecure"
+      # Cron-metrics protection.
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-metrics.rule=Host(`${COMPOSE_SERVER_DOMAIN:?}`) && PathPrefix(`/cron-metrics`) "
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-metrics.middlewares=ITKMetricsAuth@file"
+
+  memcached:
+    image: memcached:alpine
+    restart: unless-stopped
+    networks:
+      - app
+    environment:
+      - MEMCACHED_CACHE_SIZE=64

templates/drupal-10/docker-compose.yml

@@ -0,0 +1,127 @@
+# itk-version: 3.2.4
+networks:
+  frontend:
+    external: true
+  app:
+    driver: bridge
+    internal: false
+
+services:
+  mariadb:
+    image: itkdev/mariadb:latest
+    networks:
+      - app
+    ports:
+      - "3306"
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      start_period: 10s
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    environment:
+      - MYSQL_ROOT_PASSWORD=password
+      - MYSQL_USER=db
+      - MYSQL_PASSWORD=db
+      - MYSQL_DATABASE=db
+      #- ENCRYPT=1 # Uncomment to enable database encryption.
+
+  phpfpm:
+    image: itkdev/php8.4-fpm:latest
+    user: ${COMPOSE_USER:-deploy}
+    networks:
+      - app
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    environment:
+      - PHP_XDEBUG_MODE=${PHP_XDEBUG_MODE:-off}
+      - PHP_MAX_EXECUTION_TIME=30
+      - PHP_MEMORY_LIMIT=256M
+      # Depending on the setup, you may have to remove --read-envelope-from from msmtp (cf. https://marlam.de/msmtp/msmtp.html) or use SMTP to send mail
+      - PHP_SENDMAIL_PATH=/usr/bin/msmtp --host=mail --port=1025 --read-recipients --read-envelope-from
+      - DOCKER_HOST_DOMAIN=${COMPOSE_DOMAIN:?}
+      - PHP_IDE_CONFIG=serverName=localhost
+      # Let drush know the site uri (makes using --uri redundant)
+      - DRUSH_OPTIONS_URI=http://${COMPOSE_DOMAIN:?}
+    depends_on:
+      mariadb:
+        condition: service_healthy
+      memcached:
+        condition: service_healthy
+    volumes:
+      - .:/app
+
+  nginx:
+    image: nginx/nginx-unprivileged:alpine
+    networks:
+      - app
+      - frontend
+    depends_on:
+      - phpfpm
+    ports:
+      - "8080"
+    volumes:
+      - ./.docker/templates:/etc/nginx/templates:ro
+      - .:/app
+    environment:
+      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME:?}-phpfpm-1:9000
+      NGINX_CRON_METRICS: ${COMPOSE_PROJECT_NAME:?}-phpfpm-1:9746
+      NGINX_WEB_ROOT: /app/web
+      NGINX_PORT: 8080
+      NGINX_MAX_BODY_SIZE: 5M
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=frontend"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}.rule=Host(`${COMPOSE_DOMAIN:?}`)"
+      # HTTPS config - enable redirect from :80 to :443
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}.middlewares=redirect-to-https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      # Cron-metrics protection.
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-metrics.rule=Host(`${COMPOSE_DOMAIN:?}`) && PathPrefix(`/cron-metrics`) "
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-metrics.middlewares=ITKMetricsAuth@file"
+
+  memcached:
+    image: memcached:alpine
+    networks:
+      - app
+    ports:
+      - "11211"
+    healthcheck:
+      test: echo "version" | nc -vn -w 1 127.0.0.1 11211
+      interval: 10s
+      retries: 60
+    environment:
+      - MEMCACHED_CACHE_SIZE=64
+
+  mail:
+    image: axllent/mailpit
+    networks:
+      - app
+      - frontend
+    ports:
+      - "1025"
+      - "8025"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=frontend"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}mail.rule=Host(`mail-${COMPOSE_DOMAIN:?}`)"
+      - "traefik.http.services.${COMPOSE_PROJECT_NAME:?}mail.loadbalancer.server.port=8025"
+
+  # Code checks tools
+  markdownlint:
+    image: itkdev/markdownlint
+    profiles:
+      - dev
+    volumes:
+      - ./:/md
+
+  prettier:
+    # Prettier does not (yet, cf.
+    # https://github.com/prettier/prettier/issues/15206) have an official
+    # docker image.
+    # https://hub.docker.com/r/jauderho/prettier is good candidate (cf. https://hub.docker.com/search?q=prettier&sort=updated_at&order=desc)
+    image: jauderho/prettier
+    profiles:
+      - dev
+    volumes:
+      - ./:/work

templates/drupal-module/docker-compose.yml

@@ -2,7 +2,7 @@
 
 services:
   phpfpm:
-    image: itkdev/php8.4-fpm:latest
+    image: itkdev/php8.5-fpm:latest
     user: ${COMPOSE_USER:-deploy}
     volumes:
       - .:/app

templates/drupal/docker-compose.server.yml

@@ -8,7 +8,7 @@ networks:
 
 services:
   phpfpm:
-    image: itkdev/php8.4-fpm:alpine
+    image: itkdev/php8.5-fpm:alpine
     restart: unless-stopped
     networks:
       - app

templates/drupal/docker-compose.yml

@@ -27,7 +27,7 @@ services:
       #- ENCRYPT=1 # Uncomment to enable database encryption.
 
   phpfpm:
-    image: itkdev/php8.4-fpm:latest
+    image: itkdev/php8.5-fpm:latest
     user: ${COMPOSE_USER:-deploy}
     networks:
       - app

templates/symfony/docker-compose.server.yml

@@ -8,7 +8,7 @@ networks:
 
 services:
   phpfpm:
-    image: itkdev/php8.4-fpm:alpine
+    image: itkdev/php8.5-fpm:alpine
     restart: unless-stopped
     networks:
       - app

templates/symfony/docker-compose.yml

@@ -27,7 +27,7 @@ services:
       #- ENCRYPT=1 # Uncomment to enable database encryption.
 
   phpfpm:
-    image: itkdev/php8.4-fpm:latest
+    image: itkdev/php8.5-fpm:latest
     user: ${COMPOSE_USER:-deploy}
     networks:
       - app