Bank import

.dockerignore

@@ -0,0 +1,45 @@
+# VCS / IDE
+.git/
+.gitignore
+.gitattributes
+.idea/
+.vscode/
+.DS_Store
+nbproject/
+
+# Build / runtime artifacts (regenerated in image build)
+vendor/
+var/
+node_modules/
+public/assets/
+public/bundles/
+assets/vendor/
+
+# Local env / secrets (never bake into image)
+.env
+.env.local
+.env.*.local
+.env.dev
+.env.test
+
+# Test artifacts
+.phpunit
+.phpunit.result.cache
+.phpunit.cache/
+phpunit.xml
+
+# User uploads (mounted at runtime, never bake)
+public/resources/images/export/
+public/resources/images/room-categories/
+
+# Tooling
+.php-cs-fixer.php
+.php-cs-fixer.cache
+phpstan.neon
+tools/
+
+# Docker context itself (Dockerfiles under docker/ are needed)
+.dockerignore
+
+# CI
+.github/

.env.dist

@@ -36,7 +36,9 @@ RETURN_PATH=info@domain.tld
 MAIL_COPY=true
 ### mailer settings ###
 
-### redis settings (only used when APP_ENV is set to "redis") ###
+### redis settings (only used when USE_REDIS_CACHE is true) ###
+# Set to true to use Redis as Symfony cache backend, false for filesystem cache.
+USE_REDIS_CACHE=false
 REDIS_IDX=1
 REDIS_HOST=redis
 
@@ -60,4 +62,9 @@ RELYING_PARTY_ID=example.com
 RELYING_PARTY_NAME="FewohBee"
 # Enable or disable passkey login/management
 PASSKEY_ENABLED=false
-###< passkeys ###
+###< passkeys ###
+
+# this token is used to protect the health /health/ready endpoint, generate a random string and set it here, e.g. with "openssl rand -base64 32"
+# leave empty for public access to the health endpoint, which is not recommended for production environments
+# to access the health endpoint with a token, add X-Health-Token header with the token value to the request, e.g. with curl: "curl -H 'X-Health-Token: <token>' https://fewohbee/health/ready"
+HEALTH_TOKEN=

.github/workflows/images.yml

@@ -0,0 +1,190 @@
+name: Build & publish images
+
+on:
+  push:
+    branches: ['**']
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_OWNER: developeregrem
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  # -------------------------------------------------------------------------
+  # phpfpm-prod, phpfpm-debug, cli-prod — all from docker/app/Dockerfile.
+  # base/vendor-prod/app-prod stages are shared, so cache:warmup runs once per
+  # build and is reused across phpfpm-prod and cli-prod.
+  # nginx depends on phpfpm-prod and runs after.
+  # -------------------------------------------------------------------------
+  build-app:
+    name: ${{ matrix.image }} (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    # Skip duplicate runs: when a PR is opened from a same-repo branch, GitHub
+    # fires BOTH push (for the branch) and pull_request (for the PR) events.
+    # The push run is authoritative (it pushes to GHCR); the PR run would only
+    # build locally and confuse downstream jobs (nginx can't pull phpfpm).
+    # External fork PRs still run (head repo != base repo).
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name != github.repository
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: phpfpm-prod
+            image: phpfpm
+            suffix: ''
+          - target: phpfpm-debug
+            image: phpfpm
+            suffix: '-debug'
+          - target: cli-prod
+            image: cli
+            suffix: ''
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/fewohbee-${{ matrix.image }}
+          flavor: |
+            suffix=${{ matrix.suffix }},onlatest=true
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=ref,event=branch,prefix=branch-
+            type=ref,event=pr,prefix=pr-
+            type=sha,prefix=sha-
+            type=edge,branch=master
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build & push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/app/Dockerfile
+          target: ${{ matrix.target }}
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=app-${{ matrix.target }}
+          cache-to: type=gha,scope=app-${{ matrix.target }},mode=max
+
+  # -------------------------------------------------------------------------
+  # nginx pulls compiled public/assets from phpfpm-prod via COPY --from.
+  # Runs after build-app so the phpfpm image is in GHCR.
+  # -------------------------------------------------------------------------
+  build-nginx:
+    name: nginx (prod)
+    runs-on: ubuntu-latest
+    needs: build-app
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name != github.repository
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve phpfpm tag for COPY --from
+        id: phpfpm-tag
+        # Use a tag we KNOW metadata-action emits for the phpfpm-prod build:
+        #   - v* tag push  -> bare semver (4.8.0)
+        #   - branch push  -> branch-<name> (slashes/dots sanitized to '-')
+        #   - PR / other   -> sha-<short> as last resort
+        env:
+          REF: ${{ github.ref }}
+          BRANCH: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+        run: |
+          if [[ "$REF" == refs/tags/v* ]]; then
+            TAG="${REF#refs/tags/v}"
+          elif [[ "$REF" == refs/heads/* ]]; then
+            TAG="branch-${BRANCH//[\/.]/-}"
+          else
+            TAG="sha-${SHA:0:7}"
+          fi
+          echo "Resolved phpfpm tag: $TAG"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for phpfpm image to appear in GHCR
+        # build-push-action returns once the manifest list is pushed, but
+        # GHCR sometimes lags a few seconds before the tag becomes resolvable
+        # for downstream pulls. Poll the manifest with retries.
+        env:
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/fewohbee-phpfpm:${{ steps.phpfpm-tag.outputs.tag }}
+        run: |
+          for i in 1 2 3 4 5 6 7 8 9 10; do
+            if docker buildx imagetools inspect "$IMAGE" >/dev/null 2>&1; then
+              echo "phpfpm image $IMAGE is available."
+              exit 0
+            fi
+            echo "Attempt $i: $IMAGE not yet available, sleeping 5s ..."
+            sleep 5
+          done
+          echo "Giving up: phpfpm image $IMAGE not found in registry after 50s."
+          exit 1
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/fewohbee-nginx
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=ref,event=branch,prefix=branch-
+            type=ref,event=pr,prefix=pr-
+            type=sha,prefix=sha-
+            type=edge,branch=master
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build & push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/nginx/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          build-args: |
+            PHPFPM_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/fewohbee-phpfpm:${{ steps.phpfpm-tag.outputs.tag }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=nginx-prod
+          cache-to: type=gha,scope=nginx-prod,mode=max

assets/controllers/bank_import_controller.js

@@ -0,0 +1,15 @@
+import { Controller } from '@hotwired/stimulus';
+import { enableDeletePopover, enableTooltips, disposeTooltips } from '../js/utils.js';
+
+/* stimulusFetch: 'lazy' */
+
+export default class extends Controller {
+    connect() {
+        enableDeletePopover({ root: this.element });
+        enableTooltips(this.element);
+    }
+
+    disconnect() {
+        disposeTooltips(this.element);
+    }
+}