kolumbus120/churchcrm-frankenphp repository overview

⁠ChurchCRM on FrankenPHP (EXPERIMENTAL)

ChurchCRM⁠ on FrankenPHP⁠ (Caddy + PHP 8.4 in a single binary) instead of Apache. Built from the official release zip, multi-architecture (amd64, arm64).

Source, Dockerfile and issues: https://github.com/kolumbus120/churchcrm-docker⁠ (branch feature/frankenphp, docs in FRANKENPHP.md)

⁠Tags

⁠Quick start

.env:

MYSQL_USER=churchcrm
MYSQL_PASSWORD=change-me
MYSQL_ROOT_PASSWORD=change-me-too
CHURCHCRM_URL=http://localhost:8080/

docker-compose.yml:

services:
  churchcrm:
    image: kolumbus120/churchcrm-frankenphp:latest
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    ports:
      - '8080:8080'
    environment:
      - MYSQL_DB_HOST=churchcrm-db
      - MYSQL_DB_NAME=churchcrm
      - MYSQL_DB_USER=${MYSQL_USER}
      - MYSQL_DB_PASSWORD=${MYSQL_PASSWORD}
      - CHURCHCRM_URL=${CHURCHCRM_URL}
    volumes:
      - churchcrm_config:/var/www/html/config
      - churchcrm_images:/var/www/html/Images
    depends_on:
      churchcrm-db:
        condition: service_healthy

  churchcrm-db:
    image: mariadb:11.4
    restart: unless-stopped
    environment:
      - MYSQL_DATABASE=churchcrm
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      retries: 5
    volumes:
      - churchcrm_db:/var/lib/mysql

volumes:
  churchcrm_config:
  churchcrm_images:
  churchcrm_db:

docker compose up -d

Open http://localhost:8080/ and sign in as admin / changeme. You are forced to change the password on first login. The database schema is created automatically.

⁠Environment variables

Config.php is generated from these variables only on first start and then kept in the config volume. If a required variable is empty, the container exits with a clear error. Values with quotes, backslashes or $ are escaped correctly.

⁠Volumes

⁠Reverse proxy and HTTPS

The container speaks plain HTTP on 8080. It runs as www-data (UID 33) from the start (USER www-data, no root entrypoint), so it works with --user, Kubernetes runAsNonRoot, --cap-drop ALL and no-new-privileges. Bind mounts must be writable by UID/GID 33 (chown -R 33:33 ...). Put a TLS reverse proxy in front of it and send X-Forwarded-Proto: https; the image maps it to PHP's HTTPS=on. Caddy's automatic HTTPS is disabled.

⁠Differences from the Apache image

• Port 8080 instead of 80.
• Caddy ignores .htaccess. Routing and all deny rules (/Include, /logs, /tmp_attach, dotfiles, PHP in plugins/ and Images/) are in the bundled Caddyfile and must be kept in sync with upstream security fixes by hand.
• Every ChurchCRM sub-app (session, api, v2, admin, finance, kiosk, plugins, external, setup) is routed explicitly, otherwise login ends in a redirect loop.

⁠Tested / not tested

Tested: first start, login, logout and re-login, redirect loop check, deny rules, public API, X-Forwarded-Proto, non-root process (also with --cap-drop ALL and no-new-privileges), passwords with special characters.

Not tested: anything after the forced password change (people, families, finance, plugins, kiosk), photo upload, backup/restore, upgrades, behind a real reverse proxy, subdirectory installs. Please report problems on GitHub.

⁠License

ChurchCRM is MIT licensed, Copyright (c) 2023 ChurchCRM. This image only packages the unmodified release.