compose.local.yml consolidation

[msladek]

No description provided.

[fpichler]

Cross-repository consolidation recommendation

This comment applies to all three coordinated PRs and is intentionally centralized here.

The current PR heads contain byte-identical copies of .env.tomcat, compose.local.yml, the MariaDB initialization script and configuration, and the Tomcat log4j2.properties. These should be treated as one versioned Celements local-development stack rather than maintained independently in three repositories.

Recommended target

• Publish the shared Compose model as a versioned OCI artifact in the Forge, for example forge.celhosting.ch/synventis-infra/celements-local-stack:<version>.
• Reference it through the Compose include mechanism, which supports OCI and Git sources with Docker Compose 2.20.3 and later.
• Pin a released version or digest rather than latest, so local environments remain reproducible and updates are reviewed.
• Keep only application-specific values such as APP_NAME, database credentials/prefix, and ports in each repository.
• Move the shared MariaDB initialization/configuration into a versioned development image where practical. Keep application-specific xwiki.properties files local.
• If Compose 2.20.3 cannot be established as the minimum, keep generated copies in the repositories but designate one canonical template and add CI that fails when the copies drift.

The same approach can consolidate compose.build.yml: parameterize the image as ${APP_NAME}-webapp and centralize or generate the otherwise common build definition.

Shared-stack hardening

• Bind Tomcat, JPDA, and MariaDB host ports to 127.0.0.1; the current short port syntax exposes them on every host interface.
• Add a MariaDB health check and make the web service depend on condition: service_healthy, removing the manual two-step startup workaround.
• Explicitly allowlist container environment variables. The web container currently receives the full .env, including DB_ROOT_PASSWORD, although it does not need database-root credentials.
• Pin the Tomcat base image to a version or digest instead of the mutable :release tag.
• Plan and test an upgrade from mariadb:10.1, which has been unsupported since 2020.
• Add a reusable CI workflow that runs docker compose config, verifies expected services, mounts and volume names, and runs the relevant Maven/frontend checks. None of the three PRs currently reports a status check.

Remaining celements documentation issue

celements-webapp/README.md still runs docker compose up -d sqlserver, but this PR renames that service to db. Please update the command if the rename remains, or retain the existing service key as part of the compatibility fix.