ci: downgrade PHP version for static builds

* docs: add performance docs

* docs: add PHP performance section

* Update docs/performance.md

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update docs/performance.md

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update docs/performance.md

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update docs/performance.md

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update docs/performance.md

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update docs/performance.md

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update docs/performance.md

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* typo

* musl

* musl fixes

* add log section

* french translation

* typo

---------

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -7,6 +7,10 @@ body:
     attributes:
       value: |
         Thanks for taking the time to fill out this bug report!
+        Before submitting a bug, please double-check that your problem [is not
+        a known issue](https://frankenphp.dev/docs/known-issues/)
+        (especially if you use XDebug or Tideways), and that is has not
+        [already been reported](https://github.com/dunglas/frankenphp/issues).
   - type: textarea
     id: what-happened
     attributes:
@@ -65,6 +69,13 @@ body:
         - aarch64
         - Other (tell us more in the description)
       default: 0
+  - type: textarea
+    id: php
+    attributes:
+      label: PHP configuration
+      description: |
+        Please copy and paste the output of the `phpinfo()` function.
+      render: shell
     validations:
       required: true
   - type: textarea

.github/workflows/docker.yaml

@@ -1,9 +1,14 @@
 ---
 name: Build Docker images
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
 on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'docs/**'
   push:
     branches:
       - main
@@ -11,12 +16,15 @@ on:
       - v*.*.*
   workflow_dispatch:
     inputs:
+      #checkov:skip=CKV_GHA_7
       version:
         description: 'FrankenPHP version'
         required: false
         type: string
   schedule:
     - cron:  '0 4 * * *'
+permissions:
+  contents: read
 env:
   IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}
 jobs:
@@ -37,6 +45,8 @@ jobs:
       -
         name: Check PHP versions
         id: check
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           PHP_82_LATEST=$(skopeo inspect docker://docker.io/library/php:8.2 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
           PHP_83_LATEST=$(skopeo inspect docker://docker.io/library/php:8.3 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
@@ -45,13 +55,13 @@ jobs:
             echo php82_version="${PHP_82_LATEST//./-}"
             echo php83_version="${PHP_83_LATEST//./-}"
           } >> "${GITHUB_OUTPUT}"
- 
+
           # Check if the Docker images must be rebuilt
           if [[ "${GITHUB_EVENT_NAME}" != "schedule"  ]]; then
               echo skip=false >> "${GITHUB_OUTPUT}"
               exit 0
           fi
- 
+
           FRANKENPHP_82_LATEST=$(skopeo inspect docker://docker.io/dunglas/frankenphp:latest-php8.2 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
           FRANKENPHP_83_LATEST=$(skopeo inspect docker://docker.io/dunglas/frankenphp:latest-php8.3 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
 
@@ -59,7 +69,7 @@ jobs:
               echo skip=true >> "${GITHUB_OUTPUT}"
               exit 0
           fi
- 
+
           {
             echo ref="$(gh release view --repo dunglas/frankenphp --json tagName --jq '.tagName')"
             echo skip=false
@@ -71,9 +81,8 @@ jobs:
           ref: ${{ steps.check.outputs.ref }}
       -
         name: Set up Docker Buildx
+        if: ${{ !fromJson(steps.check.outputs.skip) }}
         uses: docker/setup-buildx-action@v3
-        with:
-          version: latest
       -
         name: Create variants matrix
         if: ${{ !fromJson(steps.check.outputs.skip) }}
@@ -87,9 +96,8 @@ jobs:
           } >> "${GITHUB_OUTPUT}"
         env:
           SHA: ${{ github.sha }}
-          VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || steps.check.outputs.ref || github.sha }}
+          VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || steps.check.outputs.ref || 'dev' }}
           PHP_VERSION: ${{ steps.check.outputs.php_version }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build:
     runs-on: ubuntu-latest
     needs:
@@ -135,7 +143,6 @@ jobs:
         uses: docker/setup-buildx-action@v3
         with:
           platforms: ${{ matrix.platform }}
-          version: latest
       -
         name: Login to DockerHub
         if: fromJson(needs.prepare.outputs.push)
@@ -146,7 +153,7 @@ jobs:
       -
         name: Build
         id: build
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v5
         with:
           pull: true
           load: ${{ !fromJson(needs.prepare.outputs.push) }}
@@ -160,10 +167,10 @@ jobs:
             *.cache-from=type=gha,scope=${{ needs.prepare.outputs.ref || github.ref }}-${{ matrix.platform }}
             *.cache-from=type=gha,scope=refs/heads/main-${{ matrix.platform }}
             *.cache-to=type=gha,scope=${{ needs.prepare.outputs.ref || github.ref }}-${{ matrix.platform }},ignore-error=true
-            ${{ fromJson(needs.prepare.outputs.push) && '*.output=type=image,name=dunglas/frankenphp,push-by-digest=true,name-canonical=true,push=true' || '' }}
+            ${{ fromJson(needs.prepare.outputs.push) && format('*.output=type=image,name={0},push-by-digest=true,name-canonical=true,push=true', env.IMAGE_NAME) || '' }}
         env:
           SHA: ${{ github.sha }}
-          VERSION: ${{ github.ref_type == 'tag' && github.ref_name || needs.prepare.outputs.ref || github.sha }}
+          VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || needs.prepare.outputs.ref || 'dev' }}
           PHP_VERSION: ${{ needs.prepare.outputs.php_version }}
       -
         # Workaround for https://github.com/actions/runner/pull/2477#issuecomment-1501003600
@@ -228,8 +235,6 @@ jobs:
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          version: latest
       -
         name: Login to DockerHub
         uses: docker/login-action@v3
@@ -240,9 +245,10 @@ jobs:
         name: Create manifest list and push
         working-directory: /tmp/metadata
         run: |
+          set -x
           # shellcheck disable=SC2046,SC2086
           docker buildx imagetools create $(jq -cr '.target."${{ matrix.target }}-${{ matrix.variant }}".tags | map("-t " + .) | join(" ")' <<< ${METADATA}) \
-            $(printf 'dunglas/frankenphp@sha256:%s ' *)
+            $(printf "${IMAGE_NAME}@sha256:%s " *)
         env:
           METADATA: ${{ needs.prepare.outputs.metadata }}
       -

.github/workflows/lint.yaml

@@ -7,17 +7,14 @@ on:
   push:
     branches:
       - main
-
+permissions:
+  contents: read
+  packages: read
+  statuses: write  
 jobs:
   build:
     name: Lint Code Base
     runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      packages: read
-      statuses: write
-
     steps:
       -
         name: Checkout Code
@@ -26,18 +23,21 @@ jobs:
           fetch-depth: 0
       -
         name: Lint Code Base
-        uses: super-linter/super-linter@v5
+        uses: super-linter/super-linter/slim@v6.8.0
         env:
           VALIDATE_ALL_CODEBASE: true
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           LINTER_RULES_PATH: /
-          FILTER_REGEX_EXCLUDE: '.*C-Thread-Pool/.*'
           MARKDOWN_CONFIG_FILE: .markdown-lint.yaml
           VALIDATE_CPP: false
           VALIDATE_JSCPD: false
           VALIDATE_GO: false
+          VALIDATE_GO_MODULES: false
           VALIDATE_PHP_PHPCS: false
           VALIDATE_PHP_PHPSTAN: false
           VALIDATE_PHP_PSALM: false
           VALIDATE_TERRAGRUNT: false
+          # Prettier and StandardJS are incompatible
+          VALIDATE_JAVASCRIPT_PRETTIER: false
+          VALIDATE_TYPESCRIPT_PRETTIER: false

.github/workflows/sanitizers.yaml

@@ -0,0 +1,110 @@
+---
+name: Sanitizers
+on:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - 'docs/**'
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - 'docs/**'
+permissions:
+  contents: read
+jobs:
+  # Adapted from https://github.com/beberlei/hdrhistogram-php
+  sanitizers:
+    name: ${{ matrix.sanitizer }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: ['asan', 'msan']
+    env:
+      CFLAGS: -g -O0 -fsanitize=${{ matrix.sanitizer == 'asan' && 'address' || 'memory' }}  -DZEND_TRACK_ARENA_ALLOC
+      LDFLAGS: -fsanitize=${{ matrix.sanitizer == 'asan' && 'address' || 'memory' }}
+      CC: clang
+      CXX: clang++
+      USE_ZEND_ALLOC: 0
+      LIBRARY_PATH: ${{ github.workspace }}/php/target/lib
+      LD_LIBRARY_PATH: ${{ github.workspace }}/php/target/lib
+    steps:
+      -
+        name: Remove local PHP
+        run: sudo apt-get remove --purge --autoremove 'php*' 'libmemcached*'
+      -
+        uses: actions/checkout@v4
+      -
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+          cache-dependency-path: |
+            go.sum 
+            caddy/go.sum
+      -
+        name: Determine PHP version
+        id: determine-php-version
+        run: |
+          curl -fsSL 'https://www.php.net/releases/index.php?json&max=1&version=8.3' -o version.json
+          echo version="$(jq -r 'keys[0]' version.json)" >> "$GITHUB_OUTPUT"
+          echo archive="$(jq -r '.[] .source[] | select(.filename |endswith(".xz")) | "https://www.php.net/distributions/" + .filename' version.json)" >> "$GITHUB_OUTPUT"
+      -
+        name: Cache PHP
+        id: cache-php
+        uses: actions/cache@v4
+        with:
+          path: php/target
+          key: php-sanitizers-${{ matrix.sanitizer }}-${{ runner.arch }}-${{ steps.determine-php-version.outputs.version }}
+      -
+        if: steps.cache-php.outputs.cache-hit != 'true'
+        name: Compile PHP
+        run: |
+          mkdir php/
+          curl -fsSL "${{ steps.determine-php-version.outputs.archive }}" | tar -Jx -C php --strip-components=1
+          cd php/
+          ./configure \
+            CFLAGS="$CFLAGS" \
+            LDFLAGS="$LDFLAGS" \
+            --enable-debug \
+            --enable-embed \
+            --enable-zts \
+            --enable-option-checking=fatal \
+            --disable-zend-signals \
+            --without-sqlite3 \
+            --without-pdo-sqlite \
+            --without-libxml \
+            --disable-dom \
+            --disable-simplexml \
+            --disable-xml \
+            --disable-xmlreader \
+            --disable-xmlwriter \
+            --without-pcre-jit \
+            --disable-opcache-jit \
+            --disable-cli \
+            --disable-cgi \
+            --disable-phpdbg \
+            --without-pear \
+            --disable-mbregex \
+            --enable-werror \
+            ${{ matrix.sanitizer == 'msan' && '--enable-memory-sanitizer' || '' }} \
+            --prefix="$(pwd)/target/"
+          make -j"$(getconf _NPROCESSORS_ONLN)"
+          make install
+      -
+        name: Add PHP to the PATH
+        run: echo "$(pwd)/php/target/bin" >> "$GITHUB_PATH"
+      -
+        name: Set Set CGO flags
+        run: |
+          {
+            echo "CGO_CFLAGS=$CFLAGS $(php-config --includes)"
+            echo "CGO_LDFLAGS=$LDFLAGS $(php-config --ldflags) $(php-config --libs)"
+          } >> "$GITHUB_ENV"
+      -
+        name: Compile tests
+        run: go test -${{ matrix.sanitizer }} -v -x -c
+      -
+        name: Run tests
+        run: ./frankenphp.test -test.v

.github/workflows/static.yaml

@@ -1,9 +1,14 @@
 ---
 name: Build binary releases
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
 on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'docs/**'
   push:
     branches:
       - main
@@ -11,14 +16,20 @@ on:
       - v*.*.*
   workflow_dispatch:
     inputs:
+      #checkov:skip=CKV_GHA_7
       version:
         description: 'FrankenPHP version'
         required: false
         type: string
   schedule:
     - cron:  '0 0 * * *'
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
 env:
-  IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}    
+  IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}
+  PHP_VERSION: 8.3.10 # Temporary workaround for https://github.com/dunglas/frankenphp/issues/1011
 jobs:
   prepare:
     runs-on: ubuntu-latest
@@ -48,8 +59,6 @@ jobs:
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          version: latest
       -
         name: Create platforms matrix
         id: matrix
@@ -61,18 +70,29 @@ jobs:
           } >> "${GITHUB_OUTPUT}"
         env:
           SHA: ${{ github.sha }}
-          VERSION: ${{ steps.check.outputs.ref || github.sha }}
+          VERSION: ${{ steps.check.outputs.ref || 'dev' }}
   build-linux:
     strategy:
       fail-fast: false
       matrix:
         platform: ${{ fromJson(needs.prepare.outputs.platforms) }}
+        debug: [false]
+        mimalloc: [false]
         include:
-          - race: ""
+          -
             qemu: true
-          - platform: linux/amd64
+          -
+            platform: linux/amd64
             qemu: false
-    name: Build ${{ matrix.platform }} static binary
+          -
+            platform: linux/amd64
+            qemu: false
+            debug: true
+          -
+            platform: linux/amd64
+            qemu: false
+            mimalloc: true
+    name: Build ${{ matrix.platform }} static binary${{ matrix.debug && ' (debug)' || '' }}${{ matrix.mimalloc && ' (mimalloc)' || '' }}
     runs-on: ubuntu-latest
     needs: [ prepare ]
     steps:
@@ -91,10 +111,9 @@ jobs:
         uses: docker/setup-buildx-action@v3
         with:
           platforms: ${{ matrix.platform }}
-          version: latest
       -
         name: Login to DockerHub
-        if: ${{ fromJson(needs.prepare.outputs.push) }}
+        if: ${{ fromJson(needs.prepare.outputs.push) && !matrix.debug && !matrix.mimalloc }}
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.REGISTRY_USERNAME }}
@@ -102,26 +121,29 @@ jobs:
       -
         name: Build
         id: build
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v5
         with:
           pull: true
-          load: ${{ !fromJson(needs.prepare.outputs.push) }}
+          load: ${{ !fromJson(needs.prepare.outputs.push) || matrix.debug || matrix.mimalloc }}
           targets: static-builder
           set: |
+            ${{ matrix.debug && 'static-builder.args.DEBUG_SYMBOLS=1' || '' }}
+            ${{ matrix.mimalloc && 'static-builder.args.MIMALLOC=1' || '' }}
+            ${{ matrix.platform == 'linux/arm64' && 'static-builder.args.NO_COMPRESS=1' || '' }}
             *.tags=
             *.platform=${{ matrix.platform }}
-            *.cache-from=type=gha,scope=${{ needs.prepare.outputs.ref || github.ref }}-static-builder
-            *.cache-from=type=gha,scope=refs/heads/main-static-builder
-            *.cache-to=type=gha,scope=${{ needs.prepare.outputs.ref || github.ref }}-static-builder,ignore-error=true
-            ${{ fromJson(needs.prepare.outputs.push) && '*.output=type=image,name=dunglas/frankenphp,push-by-digest=true,name-canonical=true,push=true' || '' }}
+            *.cache-from=type=gha,scope=${{ needs.prepare.outputs.ref || github.ref }}-static-builder${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }}
+            *.cache-from=type=gha,scope=refs/heads/main-static-builder${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }}
+            *.cache-to=type=gha,scope=${{ needs.prepare.outputs.ref || github.ref }}-static-builder${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }},ignore-error=true
+            ${{ (fromJson(needs.prepare.outputs.push) && !matrix.debug && !matrix.mimalloc) && format('*.output=type=image,name={0},push-by-digest=true,name-canonical=true,push=true', env.IMAGE_NAME) || '' }}
         env:
           SHA: ${{ github.sha }}
-          VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || needs.prepare.outputs.ref || github.sha}}
+          VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || needs.prepare.outputs.ref || 'dev' }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       -
         # Workaround for https://github.com/actions/runner/pull/2477#issuecomment-1501003600
         name: Export metadata
-        if: fromJson(needs.prepare.outputs.push)
+        if: fromJson(needs.prepare.outputs.push) && !matrix.debug && !matrix.mimalloc
         run: |
           mkdir -p /tmp/metadata
 
@@ -132,7 +154,7 @@ jobs:
           METADATA: ${{ steps.build.outputs.metadata }}
       -
         name: Upload metadata
-        if: fromJson(needs.prepare.outputs.push)
+        if: fromJson(needs.prepare.outputs.push) && !matrix.debug && !matrix.mimalloc
         uses: actions/upload-artifact@v3
         with:
           name: metadata-static-builder
@@ -141,11 +163,11 @@ jobs:
           retention-days: 1
       -
         name: Copy binary
-        if: ${{ !fromJson(needs.prepare.outputs.push) }}
+        if: ${{ !fromJson(needs.prepare.outputs.push) || matrix.debug || matrix.mimalloc }}
         run: |
           digest=$(jq -r '."static-builder"."containerimage.config.digest"' <<< "${METADATA}")
           docker create --platform=${{ matrix.platform }} --name static-builder "${digest}"
-          docker cp "static-builder:/go/src/app/dist/${BINARY}" "${BINARY}"
+          docker cp "static-builder:/go/src/app/dist/${BINARY}" "${BINARY}${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }}"
         env:
           METADATA: ${{ steps.build.outputs.metadata }}
           BINARY: frankenphp-linux-${{ matrix.platform == 'linux/amd64' && 'x86_64' || 'aarch64' }}
@@ -154,8 +176,20 @@ jobs:
         if: ${{ !fromJson(needs.prepare.outputs.push) }}
         uses: actions/upload-artifact@v3
         with:
-          name: frankenphp-linux-${{ matrix.platform == 'linux/amd64' && 'x86_64' || 'aarch64' }}
-          path: frankenphp-linux-${{ matrix.platform == 'linux/amd64' && 'x86_64' || 'aarch64' }}
+          name: frankenphp-linux-${{ matrix.platform == 'linux/amd64' && 'x86_64' || 'aarch64' }}${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }}
+          path: frankenphp-linux-${{ matrix.platform == 'linux/amd64' && 'x86_64' || 'aarch64' }}${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }}
+      -
+        name: Upload special assets
+        if: fromJson(needs.prepare.outputs.push) && (matrix.debug || matrix.mimalloc) && (needs.prepare.outputs.ref || github.ref_type == 'tag')
+        run: gh release upload "${{ (github.ref_type == 'tag' && github.ref_name) || needs.prepare.outputs.ref }}" frankenphp-linux-x86_64${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }} --repo dunglas/frankenphp --clobber
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      -
+        if: fromJson(needs.prepare.outputs.push) && (matrix.debug || matrix.mimalloc) && (needs.prepare.outputs.ref || github.ref_type == 'tag')
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ${{ github.workspace }}/frankenphp-linux-x86_64${{ matrix.debug && '-debug' || '' }}${{ matrix.mimalloc && '-mimalloc' || '' }}
+
   # Adapted from https://docs.docker.com/build/ci/github-actions/multi-platform/
   push:
     runs-on: ubuntu-latest
@@ -163,7 +197,6 @@ jobs:
       - prepare
       - build-linux
     if: fromJson(needs.prepare.outputs.push)
-    #if: fromJson(needs.prepare.outputs.push) && (needs.prepare.outputs.ref || github.ref_type == 'tag')
     steps:
       -
         name: Download metadata
@@ -174,8 +207,6 @@ jobs:
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          version: latest
       -
         name: Login to DockerHub
         uses: docker/login-action@v3
@@ -188,7 +219,7 @@ jobs:
         run: |
           # shellcheck disable=SC2046,SC2086
           docker buildx imagetools create $(jq -cr '.target."static-builder".tags | map("-t " + .) | join(" ")' <<< "${METADATA}") \
-            $(printf 'dunglas/frankenphp@sha256:%s ' *)
+            $(printf "${IMAGE_NAME}@sha256:%s " *)
         env:
           METADATA: ${{ needs.prepare.outputs.metadata }}
       -
@@ -212,9 +243,19 @@ jobs:
         run: gh release upload "${{ (github.ref_type == 'tag' && github.ref_name) || needs.prepare.outputs.ref }}" frankenphp-linux-x86_64 frankenphp-linux-aarch64 --repo dunglas/frankenphp --clobber
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      -
+        if: needs.prepare.outputs.ref || github.ref_type == 'tag'
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ${{ github.workspace }}/frankenphp-linux-*
+
   build-mac:
-    name: Build macOS x86_64 binaries
-    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: ['arm64', 'x86_64']
+    name: Build macOS ${{ matrix.platform }} binaries
+    runs-on: ${{ matrix.platform == 'arm64' && 'macos-14' || 'macos-13' }}
     needs: [ prepare ]
     env:
       HOMEBREW_NO_AUTO_UPDATE: 1
@@ -226,7 +267,7 @@ jobs:
       -
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.22'
           cache-dependency-path: |
             go.sum 
             caddy/go.sum
@@ -248,10 +289,15 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE: ${{ (needs.prepare.outputs.ref || github.ref_type == 'tag') && '1' || '' }}
+      -
+        if: needs.prepare.outputs.ref || github.ref_type == 'tag'
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ${{ github.workspace }}/dist/frankenphp-mac-*
       -
         name: Upload artifact
         if: github.ref_type == 'branch'
         uses: actions/upload-artifact@v3
         with:
-          name: frankenphp-mac-x86_64
-          path: dist/frankenphp-mac-x86_64
+          name: frankenphp-mac-${{ matrix.platform }}
+          path: dist/frankenphp-mac-${{ matrix.platform }}

.github/workflows/tests.yaml

@@ -4,25 +4,32 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'docs/**'
   push:
     branches:
       - main
+    paths-ignore:
+      - 'docs/**'
+permissions:
+  contents: read
 jobs:
   tests:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['8.2', '8.3']
+        php-versions: ['8.2', '8.3', '8.4']
     env:
       GOEXPERIMENT: cgocheck2
+      GOMAXPROCS: 10
     steps:
       -
         uses: actions/checkout@v4
       -
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.22'
           cache-dependency-path: |
             go.sum 
             caddy/go.sum
@@ -35,6 +42,7 @@ jobs:
           tools: none
         env:
           phpts: ts
+          debug: true
       -
         name: Set CGO flags
         run: |
@@ -66,6 +74,7 @@ jobs:
         run: ./reload_test.sh
       -
         name: Lint Go code
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v6
+        if: matrix.php-versions == '8.3'
         with:
           version: latest

C-Thread-Pool/LICENSE

@@ -1,21 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2016 Johan Hanssen Seferidis
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

C-Thread-Pool/README.md

@@ -1,70 +0,0 @@
-[![GitHub Actions](https://github.com/Pithikos/C-Thread-Pool/actions/workflows/tests.yml/badge.svg?branch=master)](https://github.com/Pithikos/C-Thread-Pool/actions?query=workflow%3Atests+branch%3Amaster)
-
-
-# C Thread Pool
-
-This is a minimal but advanced threadpool implementation.
-
-  * ANCI C and POSIX compliant
-  * Pause/resume/wait as you like
-  * Simple easy-to-digest API
-  * Well tested
-
-The threadpool is under MIT license. Notice that this project took a considerable amount of work and sacrifice of my free time and the reason I give it for free (even for commercial use) is so when you become rich and wealthy you don't forget about us open-source creatures of the night. Cheers!
-
-If this project reduced your development time feel free to buy me a coffee.
-
-[![Donate](https://www.paypal.com/en_US/i/btn/x-click-but21.gif)](https://www.paypal.me/seferidis)
-
-
-## Run an example
-
-The library is not precompiled so you have to compile it with your project. The thread pool
-uses POSIX threads so if you compile with gcc on Linux you have to use the flag `-pthread` like this:
-
-    gcc example.c thpool.c -D THPOOL_DEBUG -pthread -o example
-
-
-Then run the executable like this:
-
-    ./example
-
-
-## Basic usage
-
-1. Include the header in your source file: `#include "thpool.h"`
-2. Create a thread pool with number of threads you want: `threadpool thpool = thpool_init(4);`
-3. Add work to the pool: `thpool_add_work(thpool, (void*)function_p, (void*)arg_p);`
-
-The workers(threads) will start their work automatically as fast as there is new work
-in the pool. If you want to wait for all added work to be finished before continuing
-you can use `thpool_wait(thpool);`. If you want to destroy the pool you can use
-`thpool_destroy(thpool);`.
-
-
-## API
-
-For a deeper look into the documentation check in the [thpool.h](https://github.com/Pithikos/C-Thread-Pool/blob/master/thpool.h) file. Below is a fast practical overview.
-
-| Function example                | Description                                                         |
-|---------------------------------|---------------------------------------------------------------------|
-| ***thpool_init(4)***            | Will return a new threadpool with `4` threads.                        |
-| ***thpool_add_work(thpool, (void*)function_p, (void*)arg_p)*** | Will add new work to the pool. Work is simply a function. You can pass a single argument to the function if you wish. If not, `NULL` should be passed. |
-| ***thpool_wait(thpool)***       | Will wait for all jobs (both in queue and currently running) to finish. |
-| ***thpool_destroy(thpool)***    | This will destroy the threadpool. If jobs are currently being executed, then it will wait for them to finish. |
-| ***thpool_pause(thpool)***      | All threads in the threadpool will pause no matter if they are idle or executing work. |
-| ***thpool_resume(thpool)***      | If the threadpool is paused, then all threads will resume from where they were.   |
-| ***thpool_num_threads_working(thpool)***  | Will return the number of currently working threads.   |
-
-
-## Contribution
-
-You are very welcome to contribute. If you have a new feature in mind, you can always open an issue on github describing it so you don't end up doing a lot of work that might not be eventually merged. Generally we are very open to contributions as long as they follow the below keypoints.
-
-* Try to keep the API as minimal as possible. That means if a feature or fix can be implemented without affecting the existing API but requires more development time, then we will opt to sacrifice development time.
-* Solutions need to be POSIX compliant. The thread-pool is advertised as such so it makes sense that it actually is.
-* For coding style simply try to stick to the conventions you find in the existing codebase.
-* Tests: A new fix or feature should be covered by tests. If the existing tests are not sufficient, we expect an according test to follow with the pull request.
-* Documentation: for a new feature please add documentation. For an API change the documentation has to be thorough and super easy to understand.
-
-If you wish to **get access as a collaborator** feel free to mention it in the issue https://github.com/Pithikos/C-Thread-Pool/issues/78

C-Thread-Pool/thpool.c

@@ -1,571 +0,0 @@
-/* ********************************
- * Author:       Johan Hanssen Seferidis
- * License:	     MIT
- * Description:  Library providing a threading pool where you can add
- *               work. For usage, check the thpool.h file or README.md
- *
- *//** @file thpool.h *//*
- *
- ********************************/
-
-#if defined(__APPLE__)
-#include <AvailabilityMacros.h>
-#else
-#ifndef _POSIX_C_SOURCE
-#define _POSIX_C_SOURCE 200809L
-#endif
-#ifndef _XOPEN_SOURCE
-#define _XOPEN_SOURCE 500
-#endif
-#endif
-#include <unistd.h>
-#include <signal.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <pthread.h>
-#include <errno.h>
-#include <time.h>
-#if defined(__linux__)
-#include <sys/prctl.h>
-#endif
-#if defined(__FreeBSD__) || defined(__OpenBSD__)
-#include <pthread_np.h>
-#endif
-
-#include "thpool.h"
-
-#ifdef THPOOL_DEBUG
-#define THPOOL_DEBUG 1
-#else
-#define THPOOL_DEBUG 0
-#endif
-
-#if !defined(DISABLE_PRINT) || defined(THPOOL_DEBUG)
-#define err(str) fprintf(stderr, str)
-#else
-#define err(str)
-#endif
-
-#ifndef THPOOL_THREAD_NAME
-#define THPOOL_THREAD_NAME thpool
-#endif
-
-#define STRINGIFY(x) #x
-#define TOSTRING(x) STRINGIFY(x)
-
-static volatile int threads_keepalive;
-static volatile int threads_on_hold;
-
-
-
-/* ========================== STRUCTURES ============================ */
-
-
-/* Binary semaphore */
-typedef struct bsem {
-	pthread_mutex_t mutex;
-	pthread_cond_t   cond;
-	int v;
-} bsem;
-
-
-/* Job */
-typedef struct job{
-	struct job*  prev;                   /* pointer to previous job   */
-	void   (*function)(void* arg);       /* function pointer          */
-	void*  arg;                          /* function's argument       */
-} job;
-
-
-/* Job queue */
-typedef struct jobqueue{
-	pthread_mutex_t rwmutex;             /* used for queue r/w access */
-	job  *front;                         /* pointer to front of queue */
-	job  *rear;                          /* pointer to rear  of queue */
-	bsem *has_jobs;                      /* flag as binary semaphore  */
-	int   len;                           /* number of jobs in queue   */
-} jobqueue;
-
-
-/* Thread */
-typedef struct thread{
-	int       id;                        /* friendly id               */
-	pthread_t pthread;                   /* pointer to actual thread  */
-	struct thpool_* thpool_p;            /* access to thpool          */
-} thread;
-
-
-/* Threadpool */
-typedef struct thpool_{
-	thread**   threads;                  /* pointer to threads        */
-	volatile int num_threads_alive;      /* threads currently alive   */
-	volatile int num_threads_working;    /* threads currently working */
-	pthread_mutex_t  thcount_lock;       /* used for thread count etc */
-	pthread_cond_t  threads_all_idle;    /* signal to thpool_wait     */
-	jobqueue  jobqueue;                  /* job queue                 */
-} thpool_;
-
-
-
-
-
-/* ========================== PROTOTYPES ============================ */
-
-
-static int  thread_init(thpool_* thpool_p, struct thread** thread_p, int id);
-static void* thread_do(struct thread* thread_p);
-static void  thread_hold(int sig_id);
-static void  thread_destroy(struct thread* thread_p);
-
-static int   jobqueue_init(jobqueue* jobqueue_p);
-static void  jobqueue_clear(jobqueue* jobqueue_p);
-static void  jobqueue_push(jobqueue* jobqueue_p, struct job* newjob_p);
-static struct job* jobqueue_pull(jobqueue* jobqueue_p);
-static void  jobqueue_destroy(jobqueue* jobqueue_p);
-
-static void  bsem_init(struct bsem *bsem_p, int value);
-static void  bsem_reset(struct bsem *bsem_p);
-static void  bsem_post(struct bsem *bsem_p);
-static void  bsem_post_all(struct bsem *bsem_p);
-static void  bsem_wait(struct bsem *bsem_p);
-
-
-
-
-
-/* ========================== THREADPOOL ============================ */
-
-
-/* Initialise thread pool */
-struct thpool_* thpool_init(int num_threads){
-
-	threads_on_hold   = 0;
-	threads_keepalive = 1;
-
-	if (num_threads < 0){
-		num_threads = 0;
-	}
-
-	/* Make new thread pool */
-	thpool_* thpool_p;
-	thpool_p = (struct thpool_*)malloc(sizeof(struct thpool_));
-	if (thpool_p == NULL){
-		err("thpool_init(): Could not allocate memory for thread pool\n");
-		return NULL;
-	}
-	thpool_p->num_threads_alive   = 0;
-	thpool_p->num_threads_working = 0;
-
-	/* Initialise the job queue */
-	if (jobqueue_init(&thpool_p->jobqueue) == -1){
-		err("thpool_init(): Could not allocate memory for job queue\n");
-		free(thpool_p);
-		return NULL;
-	}
-
-	/* Make threads in pool */
-	thpool_p->threads = (struct thread**)malloc(num_threads * sizeof(struct thread *));
-	if (thpool_p->threads == NULL){
-		err("thpool_init(): Could not allocate memory for threads\n");
-		jobqueue_destroy(&thpool_p->jobqueue);
-		free(thpool_p);
-		return NULL;
-	}
-
-	pthread_mutex_init(&(thpool_p->thcount_lock), NULL);
-	pthread_cond_init(&thpool_p->threads_all_idle, NULL);
-
-	/* Thread init */
-	int n;
-	for (n=0; n<num_threads; n++){
-		thread_init(thpool_p, &thpool_p->threads[n], n);
-#if THPOOL_DEBUG
-			printf("THPOOL_DEBUG: Created thread %d in pool \n", n);
-#endif
-	}
-
-	/* Wait for threads to initialize */
-	while (thpool_p->num_threads_alive != num_threads) {}
-
-	return thpool_p;
-}
-
-
-/* Add work to the thread pool */
-int thpool_add_work(thpool_* thpool_p, void (*function_p)(void*), void* arg_p){
-	job* newjob;
-
-	newjob=(struct job*)malloc(sizeof(struct job));
-	if (newjob==NULL){
-		err("thpool_add_work(): Could not allocate memory for new job\n");
-		return -1;
-	}
-
-	/* add function and argument */
-	newjob->function=function_p;
-	newjob->arg=arg_p;
-
-	/* add job to queue */
-	jobqueue_push(&thpool_p->jobqueue, newjob);
-
-	return 0;
-}
-
-
-/* Wait until all jobs have finished */
-void thpool_wait(thpool_* thpool_p){
-	pthread_mutex_lock(&thpool_p->thcount_lock);
-	while (thpool_p->jobqueue.len || thpool_p->num_threads_working) {
-		pthread_cond_wait(&thpool_p->threads_all_idle, &thpool_p->thcount_lock);
-	}
-	pthread_mutex_unlock(&thpool_p->thcount_lock);
-}
-
-
-/* Destroy the threadpool */
-void thpool_destroy(thpool_* thpool_p){
-	/* No need to destroy if it's NULL */
-	if (thpool_p == NULL) return ;
-
-	volatile int threads_total = thpool_p->num_threads_alive;
-
-	/* End each thread 's infinite loop */
-	threads_keepalive = 0;
-
-	/* Give one second to kill idle threads */
-	double TIMEOUT = 1.0;
-	time_t start, end;
-	double tpassed = 0.0;
-	time (&start);
-	while (tpassed < TIMEOUT && thpool_p->num_threads_alive){
-		bsem_post_all(thpool_p->jobqueue.has_jobs);
-		time (&end);
-		tpassed = difftime(end,start);
-	}
-
-	/* Poll remaining threads */
-	while (thpool_p->num_threads_alive){
-		bsem_post_all(thpool_p->jobqueue.has_jobs);
-		sleep(1);
-	}
-
-	/* Job queue cleanup */
-	jobqueue_destroy(&thpool_p->jobqueue);
-	/* Deallocs */
-	int n;
-	for (n=0; n < threads_total; n++){
-		thread_destroy(thpool_p->threads[n]);
-	}
-	free(thpool_p->threads);
-	free(thpool_p);
-}
-
-
-/* Pause all threads in threadpool */
-void thpool_pause(thpool_* thpool_p) {
-	int n;
-	for (n=0; n < thpool_p->num_threads_alive; n++){
-		pthread_kill(thpool_p->threads[n]->pthread, SIGUSR1);
-	}
-}
-
-
-/* Resume all threads in threadpool */
-void thpool_resume(thpool_* thpool_p) {
-    // resuming a single threadpool hasn't been
-    // implemented yet, meanwhile this suppresses
-    // the warnings
-    (void)thpool_p;
-
-	threads_on_hold = 0;
-}
-
-
-int thpool_num_threads_working(thpool_* thpool_p){
-	return thpool_p->num_threads_working;
-}
-
-
-
-
-
-/* ============================ THREAD ============================== */
-
-
-/* Initialize a thread in the thread pool
- *
- * @param thread        address to the pointer of the thread to be created
- * @param id            id to be given to the thread
- * @return 0 on success, -1 otherwise.
- */
-static int thread_init (thpool_* thpool_p, struct thread** thread_p, int id){
-
-	*thread_p = (struct thread*)malloc(sizeof(struct thread));
-	if (*thread_p == NULL){
-		err("thread_init(): Could not allocate memory for thread\n");
-		return -1;
-	}
-
-	(*thread_p)->thpool_p = thpool_p;
-	(*thread_p)->id       = id;
-
-	pthread_create(&(*thread_p)->pthread, NULL, (void * (*)(void *)) thread_do, (*thread_p));
-	pthread_detach((*thread_p)->pthread);
-	return 0;
-}
-
-
-/* Sets the calling thread on hold */
-static void thread_hold(int sig_id) {
-    (void)sig_id;
-	threads_on_hold = 1;
-	while (threads_on_hold){
-		sleep(1);
-	}
-}
-
-
-/* What each thread is doing
-*
-* In principle this is an endless loop. The only time this loop gets interrupted is once
-* thpool_destroy() is invoked or the program exits.
-*
-* @param  thread        thread that will run this function
-* @return nothing
-*/
-static void* thread_do(struct thread* thread_p){
-
-	/* Set thread name for profiling and debugging */
-	char thread_name[16] = {0};
-
-	snprintf(thread_name, 16, TOSTRING(THPOOL_THREAD_NAME) "-%d", thread_p->id);
-
-#if defined(__linux__)
-	/* Use prctl instead to prevent using _GNU_SOURCE flag and implicit declaration */
-	prctl(PR_SET_NAME, thread_name);
-#elif defined(__APPLE__) && defined(__MACH__)
-	pthread_setname_np(thread_name);
-#elif defined(__FreeBSD__) || defined(__OpenBSD__)
-    pthread_set_name_np(thread_p->pthread, thread_name);
-#else
-	err("thread_do(): pthread_setname_np is not supported on this system");
-#endif
-
-	/* Assure all threads have been created before starting serving */
-	thpool_* thpool_p = thread_p->thpool_p;
-
-	/* Register signal handler */
-	struct sigaction act;
-	sigemptyset(&act.sa_mask);
-	act.sa_flags = SA_ONSTACK;
-	act.sa_handler = thread_hold;
-	if (sigaction(SIGUSR1, &act, NULL) == -1) {
-		err("thread_do(): cannot handle SIGUSR1");
-	}
-
-	/* Mark thread as alive (initialized) */
-	pthread_mutex_lock(&thpool_p->thcount_lock);
-	thpool_p->num_threads_alive += 1;
-	pthread_mutex_unlock(&thpool_p->thcount_lock);
-
-	while(threads_keepalive){
-
-		bsem_wait(thpool_p->jobqueue.has_jobs);
-
-		if (threads_keepalive){
-
-			pthread_mutex_lock(&thpool_p->thcount_lock);
-			thpool_p->num_threads_working++;
-			pthread_mutex_unlock(&thpool_p->thcount_lock);
-
-			/* Read job from queue and execute it */
-			void (*func_buff)(void*);
-			void*  arg_buff;
-			job* job_p = jobqueue_pull(&thpool_p->jobqueue);
-			if (job_p) {
-				func_buff = job_p->function;
-				arg_buff  = job_p->arg;
-				func_buff(arg_buff);
-				free(job_p);
-			}
-
-			pthread_mutex_lock(&thpool_p->thcount_lock);
-			thpool_p->num_threads_working--;
-			if (!thpool_p->num_threads_working) {
-				pthread_cond_signal(&thpool_p->threads_all_idle);
-			}
-			pthread_mutex_unlock(&thpool_p->thcount_lock);
-
-		}
-	}
-	pthread_mutex_lock(&thpool_p->thcount_lock);
-	thpool_p->num_threads_alive --;
-	pthread_mutex_unlock(&thpool_p->thcount_lock);
-
-	return NULL;
-}
-
-
-/* Frees a thread  */
-static void thread_destroy (thread* thread_p){
-	free(thread_p);
-}
-
-
-
-
-
-/* ============================ JOB QUEUE =========================== */
-
-
-/* Initialize queue */
-static int jobqueue_init(jobqueue* jobqueue_p){
-	jobqueue_p->len = 0;
-	jobqueue_p->front = NULL;
-	jobqueue_p->rear  = NULL;
-
-	jobqueue_p->has_jobs = (struct bsem*)malloc(sizeof(struct bsem));
-	if (jobqueue_p->has_jobs == NULL){
-		return -1;
-	}
-
-	pthread_mutex_init(&(jobqueue_p->rwmutex), NULL);
-	bsem_init(jobqueue_p->has_jobs, 0);
-
-	return 0;
-}
-
-
-/* Clear the queue */
-static void jobqueue_clear(jobqueue* jobqueue_p){
-
-	while(jobqueue_p->len){
-		free(jobqueue_pull(jobqueue_p));
-	}
-
-	jobqueue_p->front = NULL;
-	jobqueue_p->rear  = NULL;
-	bsem_reset(jobqueue_p->has_jobs);
-	jobqueue_p->len = 0;
-
-}
-
-
-/* Add (allocated) job to queue
- */
-static void jobqueue_push(jobqueue* jobqueue_p, struct job* newjob){
-
-	pthread_mutex_lock(&jobqueue_p->rwmutex);
-	newjob->prev = NULL;
-
-	switch(jobqueue_p->len){
-
-		case 0:  /* if no jobs in queue */
-					jobqueue_p->front = newjob;
-					jobqueue_p->rear  = newjob;
-					break;
-
-		default: /* if jobs in queue */
-					jobqueue_p->rear->prev = newjob;
-					jobqueue_p->rear = newjob;
-
-	}
-	jobqueue_p->len++;
-
-	bsem_post(jobqueue_p->has_jobs);
-	pthread_mutex_unlock(&jobqueue_p->rwmutex);
-}
-
-
-/* Get first job from queue(removes it from queue)
- * Notice: Caller MUST hold a mutex
- */
-static struct job* jobqueue_pull(jobqueue* jobqueue_p){
-
-	pthread_mutex_lock(&jobqueue_p->rwmutex);
-	job* job_p = jobqueue_p->front;
-
-	switch(jobqueue_p->len){
-
-		case 0:  /* if no jobs in queue */
-		  			break;
-
-		case 1:  /* if one job in queue */
-					jobqueue_p->front = NULL;
-					jobqueue_p->rear  = NULL;
-					jobqueue_p->len = 0;
-					break;
-
-		default: /* if >1 jobs in queue */
-					jobqueue_p->front = job_p->prev;
-					jobqueue_p->len--;
-					/* more than one job in queue -> post it */
-					bsem_post(jobqueue_p->has_jobs);
-
-	}
-
-	pthread_mutex_unlock(&jobqueue_p->rwmutex);
-	return job_p;
-}
-
-
-/* Free all queue resources back to the system */
-static void jobqueue_destroy(jobqueue* jobqueue_p){
-	jobqueue_clear(jobqueue_p);
-	free(jobqueue_p->has_jobs);
-}
-
-
-
-
-
-/* ======================== SYNCHRONISATION ========================= */
-
-
-/* Init semaphore to 1 or 0 */
-static void bsem_init(bsem *bsem_p, int value) {
-	if (value < 0 || value > 1) {
-		err("bsem_init(): Binary semaphore can take only values 1 or 0");
-		exit(1);
-	}
-	pthread_mutex_init(&(bsem_p->mutex), NULL);
-	pthread_cond_init(&(bsem_p->cond), NULL);
-	bsem_p->v = value;
-}
-
-
-/* Reset semaphore to 0 */
-static void bsem_reset(bsem *bsem_p) {
-	pthread_mutex_destroy(&(bsem_p->mutex));
-	pthread_cond_destroy(&(bsem_p->cond));
-	bsem_init(bsem_p, 0);
-}
-
-
-/* Post to at least one thread */
-static void bsem_post(bsem *bsem_p) {
-	pthread_mutex_lock(&bsem_p->mutex);
-	bsem_p->v = 1;
-	pthread_cond_signal(&bsem_p->cond);
-	pthread_mutex_unlock(&bsem_p->mutex);
-}
-
-
-/* Post to all threads */
-static void bsem_post_all(bsem *bsem_p) {
-	pthread_mutex_lock(&bsem_p->mutex);
-	bsem_p->v = 1;
-	pthread_cond_broadcast(&bsem_p->cond);
-	pthread_mutex_unlock(&bsem_p->mutex);
-}
-
-
-/* Wait on semaphore until semaphore has value 0 */
-static void bsem_wait(bsem* bsem_p) {
-	pthread_mutex_lock(&bsem_p->mutex);
-	while (bsem_p->v != 1) {
-		pthread_cond_wait(&bsem_p->cond, &bsem_p->mutex);
-	}
-	bsem_p->v = 0;
-	pthread_mutex_unlock(&bsem_p->mutex);
-}

C-Thread-Pool/thpool.h

@@ -1,187 +0,0 @@
-/**********************************
- * @author      Johan Hanssen Seferidis
- * License:     MIT
- *
- **********************************/
-
-#ifndef _THPOOL_
-#define _THPOOL_
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* =================================== API ======================================= */
-
-
-typedef struct thpool_* threadpool;
-
-
-/**
- * @brief  Initialize threadpool
- *
- * Initializes a threadpool. This function will not return until all
- * threads have initialized successfully.
- *
- * @example
- *
- *    ..
- *    threadpool thpool;                     //First we declare a threadpool
- *    thpool = thpool_init(4);               //then we initialize it to 4 threads
- *    ..
- *
- * @param  num_threads   number of threads to be created in the threadpool
- * @return threadpool    created threadpool on success,
- *                       NULL on error
- */
-threadpool thpool_init(int num_threads);
-
-
-/**
- * @brief Add work to the job queue
- *
- * Takes an action and its argument and adds it to the threadpool's job queue.
- * If you want to add to work a function with more than one arguments then
- * a way to implement this is by passing a pointer to a structure.
- *
- * NOTICE: You have to cast both the function and argument to not get warnings.
- *
- * @example
- *
- *    void print_num(int num){
- *       printf("%d\n", num);
- *    }
- *
- *    int main() {
- *       ..
- *       int a = 10;
- *       thpool_add_work(thpool, (void*)print_num, (void*)a);
- *       ..
- *    }
- *
- * @param  threadpool    threadpool to which the work will be added
- * @param  function_p    pointer to function to add as work
- * @param  arg_p         pointer to an argument
- * @return 0 on success, -1 otherwise.
- */
-int thpool_add_work(threadpool, void (*function_p)(void*), void* arg_p);
-
-
-/**
- * @brief Wait for all queued jobs to finish
- *
- * Will wait for all jobs - both queued and currently running to finish.
- * Once the queue is empty and all work has completed, the calling thread
- * (probably the main program) will continue.
- *
- * Smart polling is used in wait. The polling is initially 0 - meaning that
- * there is virtually no polling at all. If after 1 seconds the threads
- * haven't finished, the polling interval starts growing exponentially
- * until it reaches max_secs seconds. Then it jumps down to a maximum polling
- * interval assuming that heavy processing is being used in the threadpool.
- *
- * @example
- *
- *    ..
- *    threadpool thpool = thpool_init(4);
- *    ..
- *    // Add a bunch of work
- *    ..
- *    thpool_wait(thpool);
- *    puts("All added work has finished");
- *    ..
- *
- * @param threadpool     the threadpool to wait for
- * @return nothing
- */
-void thpool_wait(threadpool);
-
-
-/**
- * @brief Pauses all threads immediately
- *
- * The threads will be paused no matter if they are idle or working.
- * The threads return to their previous states once thpool_resume
- * is called.
- *
- * While the thread is being paused, new work can be added.
- *
- * @example
- *
- *    threadpool thpool = thpool_init(4);
- *    thpool_pause(thpool);
- *    ..
- *    // Add a bunch of work
- *    ..
- *    thpool_resume(thpool); // Let the threads start their magic
- *
- * @param threadpool    the threadpool where the threads should be paused
- * @return nothing
- */
-void thpool_pause(threadpool);
-
-
-/**
- * @brief Unpauses all threads if they are paused
- *
- * @example
- *    ..
- *    thpool_pause(thpool);
- *    sleep(10);              // Delay execution 10 seconds
- *    thpool_resume(thpool);
- *    ..
- *
- * @param threadpool     the threadpool where the threads should be unpaused
- * @return nothing
- */
-void thpool_resume(threadpool);
-
-
-/**
- * @brief Destroy the threadpool
- *
- * This will wait for the currently active threads to finish and then 'kill'
- * the whole threadpool to free up memory.
- *
- * @example
- * int main() {
- *    threadpool thpool1 = thpool_init(2);
- *    threadpool thpool2 = thpool_init(2);
- *    ..
- *    thpool_destroy(thpool1);
- *    ..
- *    return 0;
- * }
- *
- * @param threadpool     the threadpool to destroy
- * @return nothing
- */
-void thpool_destroy(threadpool);
-
-
-/**
- * @brief Show currently working threads
- *
- * Working threads are the threads that are performing work (not idle).
- *
- * @example
- * int main() {
- *    threadpool thpool1 = thpool_init(2);
- *    threadpool thpool2 = thpool_init(2);
- *    ..
- *    printf("Working threads: %d\n", thpool_num_threads_working(thpool1));
- *    ..
- *    return 0;
- * }
- *
- * @param threadpool     the threadpool of interest
- * @return integer       number of threads working
- */
-int thpool_num_threads_working(threadpool);
-
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif

CONTRIBUTING.md

@@ -19,7 +19,6 @@ If docker version is lower than 23.0, build is failed by dockerignore [pattern i
  !testdata/*.php
  !testdata/*.txt
 +!caddy
-+!C-Thread-Pool
 +!internal
 ```
 
@@ -105,6 +104,32 @@ Build FrankenPHP images from scratch for arm64 & amd64 and push to Docker Hub:
 docker buildx bake -f docker-bake.hcl --pull --no-cache --push
 ```
 
+## Debugging Segmentation Faults With Static Builds
+
+1. Download the debug version of the FrankenPHP binary from GitHub or create your custom static build including debug symbols:
+
+    ```console
+    docker buildx bake \
+        --load \
+        --set static-builder.args.DEBUG_SYMBOLS=1 \
+        --set "static-builder.platform=linux/amd64" \
+        static-builder
+    docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/dist/frankenphp-linux-$(uname -m) frankenphp
+    ```
+
+2. Replace your current version of `frankenphp` by the debug FrankenPHP executable
+3. Start FrankenPHP as usual (alternatively, you can directly start FrankenPHP with GDB: `gdb --args ./frankenphp run`)
+4. Attach to the process with GDB:
+
+    ```console
+    gdb -p `pidof frankenphp`
+    ```
+
+5. If necessary, type `continue` in the GDB shell
+6. Make FrankenPHP crash
+7. Type `bt` in the GDB shell
+8. Copy the output
+
 ## Debugging Segmentation Faults in GitHub Actions
 
 1. Open `.github/workflows/tests.yml`
@@ -175,3 +200,17 @@ docker buildx bake -f docker-bake.hcl --pull --no-cache --push
 apk add strace util-linux gdb
 strace -e 'trace=!futex,epoll_ctl,epoll_pwait,tgkill,rt_sigreturn' -p 1
 ```
+
+## Translating the Documentation
+
+To translate the documentation and the site in a new language,
+follow these steps:
+
+1. Create a new directory named with the language's 2-character ISO code in this repository's `docs/` directory
+2. Copy all the `.md` files in the root of the `docs/` directory into the new directory (always use the English version as source for translation, as it's always up to date)
+3. Copy the `README.md` and `CONTRIBUTING.md` files from the root directory to the new directory
+4. Translate the content of the files, but don't change the filenames, also don't translates strings starting with `> [!` (it's special markup for GitHub)
+5. Create a Pull Request with the translations
+6. In the [site repository](https://github.com/dunglas/frankenphp-website/tree/main), copy and translate the translation files in the `content/`, `data/` and `i18n/` directories
+7. Translate the values in the created YAML file
+8. Open a Pull Request on the site repository

Dockerfile

@@ -1,4 +1,7 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM php-base AS common
 
 WORKDIR /app
@@ -27,8 +30,8 @@ CMD ["--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
 HEALTHCHECK CMD curl -f http://localhost:2019/metrics || exit 1
 
 # See https://caddyserver.com/docs/conventions#file-locations for details
-ENV XDG_CONFIG_HOME /config
-ENV XDG_DATA_HOME /data
+ENV XDG_CONFIG_HOME=/config
+ENV XDG_DATA_HOME=/data
 
 EXPOSE 80
 EXPOSE 443
@@ -50,7 +53,7 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 COPY --from=golang-base /usr/local/go /usr/local/go
 
-ENV PATH /usr/local/go/bin:$PATH
+ENV PATH=/usr/local/go/bin:$PATH
 
 # This is required to link the FrankenPHP binary to the PHP binary
 RUN apt-get update && \
@@ -80,13 +83,13 @@ RUN go mod graph | awk '{if ($1 !~ "@") print $2}' | xargs go get
 WORKDIR /go/src/app
 COPY --link *.* ./
 COPY --link caddy caddy
-COPY --link C-Thread-Pool C-Thread-Pool
 COPY --link internal internal
 COPY --link testdata testdata
 
-# todo: automate this?
-# see https://github.com/docker-library/php/blob/master/8.2/bookworm/zts/Dockerfile#L57-L59 for PHP values
-ENV CGO_LDFLAGS="-lssl -lcrypto -lreadline -largon2 -lcurl -lonig -lz $PHP_LDFLAGS" CGO_CFLAGS="-DFRANKENPHP_VERSION=$FRANKENPHP_VERSION $PHP_CFLAGS" CGO_CPPFLAGS=$PHP_CPPFLAGS
+# See https://github.com/docker-library/php/blob/master/8.3/bookworm/zts/Dockerfile#L57-L59 for PHP values
+ENV CGO_CFLAGS="-DFRANKENPHP_VERSION=$FRANKENPHP_VERSION $PHP_CFLAGS"
+ENV CGO_CPPFLAGS=$PHP_CPPFLAGS
+ENV CGO_LDFLAGS="-lssl -lcrypto -lreadline -largon2 -lcurl -lonig -lz $PHP_LDFLAGS"
 
 WORKDIR /go/src/app/caddy/frankenphp
 RUN GOBIN=/usr/local/bin go install -ldflags "-w -s -X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP $FRANKENPHP_VERSION PHP $PHP_VERSION Caddy'" && \

README.md

@@ -6,7 +6,7 @@ FrankenPHP is a modern application server for PHP built on top of the [Caddy](ht
 
 FrankenPHP gives superpowers to your PHP apps thanks to its stunning features: [*Early Hints*](https://frankenphp.dev/docs/early-hints/), [worker mode](https://frankenphp.dev/docs/worker/), [real-time capabilities](https://frankenphp.dev/docs/mercure/), automatic HTTPS, HTTP/2, and HTTP/3 support...
 
-FrankenPHP works with any PHP app and makes your Symfony and Laravel projects faster than ever thanks to the provided integration with the worker mode.
+FrankenPHP works with any PHP app and makes your Laravel and Symfony projects faster than ever thanks to their official integrations with the worker mode.
 
 FrankenPHP can also be used as a standalone Go library to embed PHP in any app using `net/http`.
 
@@ -28,7 +28,7 @@ Go to `https://localhost`, and enjoy!
 
 > [!TIP]
 >
-> Do not attempt to use `https://127.0.0.1`. Use `localhost` and accept the self-signed certificate.
+> Do not attempt to use `https://127.0.0.1`. Use `https://localhost` and accept the self-signed certificate.
 > Use the [`SERVER_NAME` environment variable](docs/config.md#environment-variables) to change the domain to use.
 
 ### Standalone Binary
@@ -55,10 +55,12 @@ You can also run command-line scripts with:
 * [Real-time](https://frankenphp.dev/docs/mercure/)
 * [Configuration](https://frankenphp.dev/docs/config/)
 * [Docker images](https://frankenphp.dev/docs/docker/)
-* [Deploy in production](docs/production.md)
+* [Deploy in production](https://frankenphp.dev/docs/production/)
+* [Performance optimization](https://frankenphp.dev/docs/performance/)
 * [Create **standalone**, self-executable PHP apps](https://frankenphp.dev/docs/embed/)
 * [Create static binaries](https://frankenphp.dev/docs/static/)
 * [Compile from sources](https://frankenphp.dev/docs/compile/)
+* [Laravel integration](https://frankenphp.dev/docs/laravel/)
 * [Known issues](https://frankenphp.dev/docs/known-issues/)
 * [Demo app (Symfony) and benchmarks](https://github.com/dunglas/frankenphp-demo)
 * [Go library documentation](https://pkg.go.dev/github.com/dunglas/frankenphp)
@@ -70,7 +72,7 @@ You can also run command-line scripts with:
 * [API Platform](https://api-platform.com/docs/distribution/)
 * [Laravel](https://frankenphp.dev/docs/laravel/)
 * [Sulu](https://sulu.io/blog/running-sulu-with-frankenphp)
-* [WordPress](https://github.com/dunglas/frankenphp-wordpress)
+* [WordPress](https://github.com/StephenMiracle/frankenwp)
 * [Drupal](https://github.com/dunglas/frankenphp-drupal)
 * [Joomla](https://github.com/alexandreelise/frankenphp-joomla)
 * [TYPO3](https://github.com/ochorocho/franken-typo3)

SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest version is supported.
+Please ensure that you're always using the latest release.
+
+Binaries and Docker images are rebuilt nightly using the latest versions of dependencies.
+
+## Reporting a Vulnerability
+
+If you believe you have discovered a security issue directly affecting FrankenPHP,
+please do **NOT** report it publicly but send a detailed report to [kevin+frankenphp-security@dunglas.dev](mailto:kevin+frankenphp-security@dunglas.dev?subject=Security%20issue%20affecting%20FrankenPHP).
+
+Only vulnerabilities directly affecting FrankenPHP should be reported using this email.
+Flaws affecting components used by FrankenPHP (PHP, Caddy, Go...) or using FrankenPHP (Laravel Octane, PHP Runtime...) should be reported to the relevant projects.

alpine.Dockerfile

@@ -1,6 +1,11 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM php-base AS common
 
+ARG TARGETARCH
+
 WORKDIR /app
 
 RUN apk add --no-cache \
@@ -24,8 +29,8 @@ CMD ["--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
 HEALTHCHECK CMD curl -f http://localhost:2019/metrics || exit 1
 
 # See https://caddyserver.com/docs/conventions#file-locations for details
-ENV XDG_CONFIG_HOME /config
-ENV XDG_DATA_HOME /data
+ENV XDG_CONFIG_HOME=/config
+ENV XDG_DATA_HOME=/data
 
 EXPOSE 80
 EXPOSE 443
@@ -47,7 +52,7 @@ SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 
 COPY --link --from=golang-base /usr/local/go /usr/local/go
 
-ENV PATH /usr/local/go/bin:$PATH
+ENV PATH=/usr/local/go/bin:$PATH
 
 # hadolint ignore=SC2086
 RUN apk add --no-cache --virtual .build-deps \
@@ -63,7 +68,26 @@ RUN apk add --no-cache --virtual .build-deps \
 	oniguruma-dev \
 	openssl-dev \
 	readline-dev \
-	sqlite-dev
+	sqlite-dev \
+	upx \
+	# Needed for the custom Go build
+	git \
+	bash
+
+# FIXME: temporary workaround for https://github.com/golang/go/issues/68285
+WORKDIR /
+RUN git clone https://go.googlesource.com/go goroot
+WORKDIR /goroot
+# Revert https://github.com/golang/go/commit/3560cf0afb3c29300a6c88ccd98256949ca7a6f6 to prevent the crash with musl
+RUN git config --global user.email "build@example.com" && \
+	git config --global user.name "Build" && \
+	git checkout "$(go env GOVERSION)" && \
+	git revert 3560cf0afb3c29300a6c88ccd98256949ca7a6f6
+WORKDIR /goroot/src
+ENV GOHOSTARCH="$TARGETARCH"
+RUN ./make.bash
+ENV PATH="/goroot/bin:$PATH"
+RUN go version
 
 WORKDIR /go/src/app
 
@@ -77,17 +101,18 @@ RUN go mod graph | awk '{if ($1 !~ "@") print $2}' | xargs go get
 WORKDIR /go/src/app
 COPY --link *.* ./
 COPY --link caddy caddy
-COPY --link C-Thread-Pool C-Thread-Pool
 COPY --link internal internal
 COPY --link testdata testdata
 
-# todo: automate this?
-# see https://github.com/docker-library/php/blob/master/8.2/bookworm/zts/Dockerfile#L57-L59 for php values
-ENV CGO_LDFLAGS="-lssl -lcrypto -lreadline -largon2 -lcurl -lonig -lz $PHP_LDFLAGS" CGO_CFLAGS="-DFRANKENPHP_VERSION=$FRANKENPHP_VERSION $PHP_CFLAGS" CGO_CPPFLAGS=$PHP_CPPFLAGS
+# See https://github.com/docker-library/php/blob/master/8.3/alpine3.20/zts/Dockerfile#L53-L55
+ENV CGO_CFLAGS="-DFRANKENPHP_VERSION=$FRANKENPHP_VERSION $PHP_CFLAGS"
+ENV CGO_CPPFLAGS=$PHP_CPPFLAGS
+ENV CGO_LDFLAGS="-lssl -lcrypto -lreadline -largon2 -lcurl -lonig -lz $PHP_LDFLAGS"
 
 WORKDIR /go/src/app/caddy/frankenphp
 RUN GOBIN=/usr/local/bin go install -ldflags "-w -s -extldflags '-Wl,-z,stack-size=0x80000' -X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP $FRANKENPHP_VERSION PHP $PHP_VERSION Caddy'" && \
 	setcap cap_net_bind_service=+ep /usr/local/bin/frankenphp && \
+	upx --best /usr/local/bin/frankenphp && \
 	frankenphp version
 
 WORKDIR /go/src/app

build-static.sh

@@ -1,137 +1,240 @@
 #!/bin/sh
 
 set -o errexit
+set -x
 
-if ! type "git" > /dev/null; then
-    echo "The \"git\" command must be installed."
-    exit 1
+if ! type "git" >/dev/null 2>&1; then
+	echo "The \"git\" command must be installed."
+	exit 1
 fi
 
 arch="$(uname -m)"
 os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+md5binary="md5sum"
 if [ "${os}" = "darwin" ]; then
-    os="mac"
+	os="mac"
+	md5binary="md5 -q"
+fi
+
+if [ "${os}" = "linux" ] && ! type "cmake" >/dev/null 2>&1; then
+	echo "The \"cmake\" command must be installed."
+	exit 1
 fi
 
 if [ -z "${PHP_EXTENSIONS}" ]; then
-    if [ "${os}" = "mac" ] && [ "${arch}" = "x86_64" ]; then
-        # Temporary fix for https://github.com/crazywhalecc/static-php-cli/issues/280 (remove ldap)
-        export PHP_EXTENSIONS="apcu,bcmath,bz2,calendar,ctype,curl,dba,dom,exif,fileinfo,filter,gd,iconv,igbinary,intl,mbregex,mbstring,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sodium,sqlite3,sysvsem,tokenizer,xml,xmlreader,xmlwriter,zip,zlib"
-    else
-        export PHP_EXTENSIONS="apcu,bcmath,bz2,calendar,ctype,curl,dba,dom,exif,fileinfo,filter,gd,iconv,igbinary,intl,ldap,mbregex,mbstring,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sodium,sqlite3,sysvsem,tokenizer,xml,xmlreader,xmlwriter,zip,zlib" 
-    fi
+	if [ -n "${EMBED}" ] && [ -f "${EMBED}/composer.json" ]; then
+		cd "${EMBED}"
+		PHP_EXTENSIONS="$(composer check-platform-reqs --no-dev 2>/dev/null | grep ^ext | sed -e 's/^ext-//' -e 's/ .*//' | xargs | tr ' ' ',')"
+		export PHP_EXTENSIONS
+		cd -
+	else
+		export PHP_EXTENSIONS="apcu,bcmath,bz2,calendar,ctype,curl,dba,dom,exif,fileinfo,filter,ftp,gd,gmp,gettext,iconv,igbinary,imagick,intl,ldap,mbregex,mbstring,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,protobuf,readline,redis,session,shmop,simplexml,soap,sockets,sodium,sqlite3,ssh2,sysvmsg,sysvsem,sysvshm,tidy,tokenizer,xlswriter,xml,xmlreader,xmlwriter,zip,zlib,yaml,zstd"
+	fi
 fi
 
 if [ -z "${PHP_EXTENSION_LIBS}" ]; then
-    export PHP_EXTENSION_LIBS="bzip2,freetype,libavif,libjpeg,liblz4,libwebp,libzip"
+	export PHP_EXTENSION_LIBS="bzip2,freetype,libavif,libjpeg,liblz4,libwebp,libzip,nghttp2"
+fi
+
+# The Brotli library must always be built as it is required by http://github.com/dunglas/caddy-cbrotli
+if ! echo "${PHP_EXTENSION_LIBS}" | grep -q "\bbrotli\b"; then
+	export PHP_EXTENSION_LIBS="${PHP_EXTENSION_LIBS},brotli"
 fi
 
 if [ -z "${PHP_VERSION}" ]; then
-    export PHP_VERSION="8.3"
+	export PHP_VERSION="8.3"
 fi
 
 if [ -z "${FRANKENPHP_VERSION}" ]; then
-    FRANKENPHP_VERSION="$(git rev-parse --verify HEAD)"
-    export FRANKENPHP_VERSION
+	FRANKENPHP_VERSION="$(git rev-parse --verify HEAD)"
+	export FRANKENPHP_VERSION
 elif [ -d ".git/" ]; then
-    CURRENT_REF="$(git rev-parse --abbrev-ref HEAD)"
-    export CURRENT_REF
+	CURRENT_REF="$(git rev-parse --abbrev-ref HEAD)"
+	export CURRENT_REF
 
-    if echo "${FRANKENPHP_VERSION}" | grep -F -q "."; then
-        # Tag
+	if echo "${FRANKENPHP_VERSION}" | grep -F -q "."; then
+		# Tag
 
-        # Trim "v" prefix if any
-        FRANKENPHP_VERSION=${FRANKENPHP_VERSION#v}
-        export FRANKENPHP_VERSION
+		# Trim "v" prefix if any
+		FRANKENPHP_VERSION=${FRANKENPHP_VERSION#v}
+		export FRANKENPHP_VERSION
 
-        git checkout "v${FRANKENPHP_VERSION}"
-    else
-        git checkout "${FRANKENPHP_VERSION}"
-    fi
+		git checkout "v${FRANKENPHP_VERSION}"
+	else
+		git checkout "${FRANKENPHP_VERSION}"
+	fi
 fi
 
 bin="frankenphp-${os}-${arch}"
 
 if [ -n "${CLEAN}" ]; then
-    rm -Rf dist/
-    go clean -cache
+	rm -Rf dist/
+	go clean -cache
 fi
 
-# Build libphp if ncessary
+# Build libphp if necessary
 if [ -f "dist/static-php-cli/buildroot/lib/libphp.a" ]; then
-    cd dist/static-php-cli    
+	cd dist/static-php-cli
 else
-    mkdir -p dist/
-    cd dist/
+	mkdir -p dist/
+	cd dist/
 
-    if [ -d "static-php-cli/" ]; then
-        cd static-php-cli/
-        git pull
-    else
-        git clone --depth 1 https://github.com/crazywhalecc/static-php-cli
-        cd static-php-cli/
-    fi
+	if [ -d "static-php-cli/" ]; then
+		cd static-php-cli/
+		git pull
+	else
+		git clone --depth 1 https://github.com/crazywhalecc/static-php-cli
+		cd static-php-cli/
+	fi
 
-    if type "brew" > /dev/null; then
-        packages="composer"
-        if ! type "go" > /dev/null; then
-            packages="${packages} go"
-        fi
-        if [ -n "${RELEASE}" ]; then
-            packages="${packages} gh"
-        fi
+	if type "brew" >/dev/null 2>&1; then
+		if ! type "composer" >/dev/null; then
+			packages="composer"
+		fi
+		if ! type "go" >/dev/null; then
+			packages="${packages} go"
+		fi
+		if [ -n "${RELEASE}" ] && ! type "gh" >/dev/null 2>&1; then
+			packages="${packages} gh"
+		fi
 
-        # shellcheck disable=SC2086
-        brew install --formula --quiet ${packages}
-    fi
+		if [ -n "${packages}" ]; then
+			# shellcheck disable=SC2086
+			brew install --formula --quiet ${packages}
+		fi
+	fi
 
-    composer install --no-dev -a
+	composer install --no-dev -a
 
-    if [ "${os}" = "linux" ]; then
-        extraOpts="--disable-opcache-jit"
-    fi
+	if [ "${os}" = "linux" ]; then
+		extraOpts="--disable-opcache-jit"
+	fi
 
-    if [ -n "${DEBUG_SYMBOLS}" ]; then
-        extraOpts="${extraOpts} --no-strip"
-    fi
+	if [ -n "${DEBUG_SYMBOLS}" ]; then
+		extraOpts="${extraOpts} --no-strip"
+	fi
 
-    ./bin/spc doctor
-    ./bin/spc fetch --with-php="${PHP_VERSION}" --for-extensions="${PHP_EXTENSIONS}"
-    # the Brotli library must always be built as it is required by http://github.com/dunglas/caddy-cbrotli
-    # shellcheck disable=SC2086
-    ./bin/spc build --enable-zts --build-embed ${extraOpts} "${PHP_EXTENSIONS}" --with-libs="brotli,${PHP_EXTENSION_LIBS}"
+	./bin/spc doctor --auto-fix
+	./bin/spc download --with-php="${PHP_VERSION}" --for-extensions="${PHP_EXTENSIONS}" --for-libs="${PHP_EXTENSION_LIBS}" --ignore-cache-sources=php-src --prefer-pre-built
+	# shellcheck disable=SC2086
+	./bin/spc build --debug --enable-zts --build-embed ${extraOpts} "${PHP_EXTENSIONS}" --with-libs="${PHP_EXTENSION_LIBS}"
 fi
 
+# See https://github.com/docker-library/php/blob/master/8.3/alpine3.20/zts/Dockerfile#L53-L55
 CGO_CFLAGS="-DFRANKENPHP_VERSION=${FRANKENPHP_VERSION} -I${PWD}/buildroot/include/ $(./buildroot/bin/php-config --includes | sed s#-I/#-I"${PWD}"/buildroot/#g)"
 if [ -n "${DEBUG_SYMBOLS}" ]; then
-    CGO_CFLAGS="-g ${CGO_CFLAGS}"
+	CGO_CFLAGS="-g ${CGO_CFLAGS}"
+else
+	CGO_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 ${CGO_CFLAGS}"
 fi
 export CGO_CFLAGS
+export CGO_CPPFLAGS="${CGO_CFLAGS}"
 
 if [ "${os}" = "mac" ]; then
-    export CGO_LDFLAGS="-framework CoreFoundation -framework SystemConfiguration"
+	export CGO_LDFLAGS="-framework CoreFoundation -framework SystemConfiguration"
+elif [ "${os}" = "linux" ] && [ -z "${DEBUG_SYMBOLS}" ]; then
+	CGO_LDFLAGS="-Wl,-O1 -pie"
 fi
 
-CGO_LDFLAGS="${CGO_LDFLAGS} ${PWD}/buildroot/lib/libbrotlicommon.a ${PWD}/buildroot/lib/libbrotlienc.a ${PWD}/buildroot/lib/libbrotlidec.a $(./buildroot/bin/php-config --ldflags) $(./buildroot/bin/php-config --libs)"
+CGO_LDFLAGS="${CGO_LDFLAGS} ${PWD}/buildroot/lib/libbrotlicommon.a ${PWD}/buildroot/lib/libbrotlienc.a ${PWD}/buildroot/lib/libbrotlidec.a $(./buildroot/bin/php-config --ldflags || true) $(./buildroot/bin/php-config --libs || true)"
+if [ "${os}" = "linux" ]; then
+	if echo "${PHP_EXTENSIONS}" | grep -qE "\b(intl|imagick|grpc|v8js|protobuf|mongodb|tbb)\b"; then
+		CGO_LDFLAGS="${CGO_LDFLAGS} -lstdc++"
+	fi
+fi
 export CGO_LDFLAGS
 
 LIBPHP_VERSION="$(./buildroot/bin/php-config --version)"
 export LIBPHP_VERSION
 
-cd ../..
-
-# Embed PHP app, if any
-if [ -n "${EMBED}" ] && [ -d "${EMBED}" ]; then
-    tar -cf app.tar -C "${EMBED}" .
-    md5 -q app.tar > app_checksum.txt
-fi
+cd ../
 
 if [ "${os}" = "linux" ]; then
-    extraExtldflags="-Wl,-z,stack-size=0x80000"
+	if [ -n "${MIMALLOC}" ]; then
+		# Replace musl's mallocng by mimalloc
+		# The default musl allocator is slow, especially when used by multi-threaded apps,
+		# and triggers weird bugs
+		# Adapted from https://www.tweag.io/blog/2023-08-10-rust-static-link-with-mimalloc/
+
+		echo 'The USE_MIMALLOC environment variable is EXPERIMENTAL.'
+		echo 'This option can be removed or its behavior modified at any time.'
+
+		if [ ! -f "mimalloc/out/libmimalloc.a" ]; then
+			if [ -d "mimalloc" ]; then
+				cd mimalloc/
+				git reset --hard
+				git clean -xdf
+				git fetch --tags
+			else
+				git clone https://github.com/microsoft/mimalloc.git
+				cd mimalloc/
+			fi
+
+			git checkout "$(git describe --tags "$(git rev-list --tags --max-count=1 || true)" || true)"
+
+			curl -f -L --retry 5 https://raw.githubusercontent.com/tweag/rust-alpine-mimalloc/b26002b49d466a295ea8b50828cb7520a71a872a/mimalloc.diff -o mimalloc.diff
+			patch -p1 <mimalloc.diff
+
+			mkdir -p out/
+			cd out/
+			if [ -n "${DEBUG_SYMBOLS}" ]; then
+				cmake \
+					-DCMAKE_BUILD_TYPE=Debug \
+					-DMI_BUILD_SHARED=OFF \
+					-DMI_BUILD_OBJECT=OFF \
+					-DMI_BUILD_TESTS=OFF \
+					../
+			else
+				cmake \
+					-DCMAKE_BUILD_TYPE=Release \
+					-DMI_BUILD_SHARED=OFF \
+					-DMI_BUILD_OBJECT=OFF \
+					-DMI_BUILD_TESTS=OFF \
+					../
+			fi
+			make -j"$(nproc || true)"
+
+			cd ../../
+		fi
+
+		if [ -n "${DEBUG_SYMBOLS}" ]; then
+			libmimalloc_path=mimalloc/out/libmimalloc-debug.a
+		else
+			libmimalloc_path=mimalloc/out/libmimalloc.a
+		fi
+
+		# Patch musl library to use mimalloc
+		for libc_path in "/usr/local/musl/lib/libc.a" "/usr/local/musl/$(uname -m)-linux-musl/lib/libc.a" "/usr/lib/libc.a"; do
+			if [ ! -f "${libc_path}" ] || [ -f "${libc_path}.unpatched" ]; then
+				continue
+			fi
+
+			{
+				echo "CREATE libc.a"
+				echo "ADDLIB ${libc_path}"
+				echo "DELETE aligned_alloc.lo calloc.lo donate.lo free.lo libc_calloc.lo lite_malloc.lo malloc.lo malloc_usable_size.lo memalign.lo posix_memalign.lo realloc.lo reallocarray.lo valloc.lo"
+				echo "ADDLIB ${libmimalloc_path}"
+				echo "SAVE"
+			} | ar -M
+			mv "${libc_path}" "${libc_path}.unpatched"
+			mv libc.a "${libc_path}"
+		done
+	fi
+
+	# Increase the default stack size to prevents issues with code including many files such as Symfony containers
+	extraExtldflags="-Wl,-z,stack-size=0x80000"
 fi
 
 if [ -z "${DEBUG_SYMBOLS}" ]; then
-    extraLdflags="-w -s"
+	extraLdflags="-w -s"
+fi
+
+cd ../
+
+# Embed PHP app, if any
+if [ -n "${EMBED}" ] && [ -d "${EMBED}" ]; then
+	tar -cf app.tar -C "${EMBED}" .
+	${md5binary} app.tar | awk '{printf $1}' >app_checksum.txt
 fi
 
 cd caddy/frankenphp/
@@ -140,16 +243,20 @@ go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkm
 cd ../..
 
 if [ -d "${EMBED}" ]; then
-    truncate -s 0 app.tar
-    truncate -s 0 app_checksum.txt
+	truncate -s 0 app.tar
+	truncate -s 0 app_checksum.txt
+fi
+
+if type "upx" >/dev/null 2>&1 && [ -z "${DEBUG_SYMBOLS}" ] && [ -z "${NO_COMPRESS}" ]; then
+	upx --best "dist/${bin}"
 fi
 
 "dist/${bin}" version
 
 if [ -n "${RELEASE}" ]; then
-    gh release upload "v${FRANKENPHP_VERSION}" "dist/${bin}" --repo dunglas/frankenphp --clobber
+	gh release upload "v${FRANKENPHP_VERSION}" "dist/${bin}" --repo dunglas/frankenphp --clobber
 fi
 
 if [ -n "${CURRENT_REF}" ]; then
-    git checkout "${CURRENT_REF}"
+	git checkout "${CURRENT_REF}"
 fi

caddy/caddy.go

@@ -6,9 +6,11 @@ package caddy
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"path/filepath"
 	"strconv"
+	"strings"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -26,9 +28,14 @@ const defaultDocumentRoot = "public"
 func init() {
 	caddy.RegisterModule(FrankenPHPApp{})
 	caddy.RegisterModule(FrankenPHPModule{})
+
 	httpcaddyfile.RegisterGlobalOption("frankenphp", parseGlobalOption)
+
 	httpcaddyfile.RegisterHandlerDirective("php", parseCaddyfile)
+	httpcaddyfile.RegisterDirectiveOrder("php", "before", "file_server")
+
 	httpcaddyfile.RegisterDirective("php_server", parsePhpServer)
+	httpcaddyfile.RegisterDirectiveOrder("php_server", "before", "file_server")
 }
 
 type mainPHPinterpreterKeyType int
@@ -203,10 +210,14 @@ type FrankenPHPModule struct {
 	// SplitPath sets the substrings for splitting the URI into two parts. The first matching substring will be used to split the "path info" from the path. The first piece is suffixed with the matching substring and will be assumed as the actual resource (CGI script) name. The second piece will be set to PATH_INFO for the CGI script to use. Default: `.php`.
 	SplitPath []string `json:"split_path,omitempty"`
 	// ResolveRootSymlink enables resolving the `root` directory to its actual value by evaluating a symbolic link, if one exists.
-	ResolveRootSymlink bool `json:"resolve_root_symlink,omitempty"`
+	ResolveRootSymlink *bool `json:"resolve_root_symlink,omitempty"`
 	// Env sets an extra environment variable to the given value. Can be specified more than once for multiple environment variables.
-	Env    map[string]string `json:"env,omitempty"`
-	logger *zap.Logger
+	Env map[string]string `json:"env,omitempty"`
+
+	resolvedDocumentRoot        string
+	preparedEnv                 frankenphp.PreparedEnv
+	preparedEnvNeedsReplacement bool
+	logger                      *zap.Logger
 }
 
 // CaddyModule returns the Caddy module information.
@@ -225,8 +236,9 @@ func (f *FrankenPHPModule) Provision(ctx caddy.Context) error {
 		if frankenphp.EmbeddedAppPath == "" {
 			f.Root = "{http.vars.root}"
 		} else {
+			rrs := false
 			f.Root = filepath.Join(frankenphp.EmbeddedAppPath, defaultDocumentRoot)
-			f.ResolveRootSymlink = false
+			f.ResolveRootSymlink = &rrs
 		}
 	} else {
 		if frankenphp.EmbeddedAppPath != "" && filepath.IsLocal(f.Root) {
@@ -238,28 +250,76 @@ func (f *FrankenPHPModule) Provision(ctx caddy.Context) error {
 		f.SplitPath = []string{".php"}
 	}
 
+	if f.ResolveRootSymlink == nil {
+		rrs := true
+		f.ResolveRootSymlink = &rrs
+	}
+
+	if !needReplacement(f.Root) {
+		root, err := filepath.Abs(f.Root)
+		if err != nil {
+			return fmt.Errorf("unable to make the root path absolute: %w", err)
+		}
+		f.resolvedDocumentRoot = root
+
+		if *f.ResolveRootSymlink {
+			root, err := filepath.EvalSymlinks(root)
+			if err != nil {
+				return fmt.Errorf("unable to resolve root symlink: %w", err)
+			}
+
+			f.resolvedDocumentRoot = root
+		}
+	}
+
+	if f.preparedEnv == nil {
+		f.preparedEnv = frankenphp.PrepareEnv(f.Env)
+
+		for e := range f.preparedEnv {
+			if needReplacement(e) {
+				f.preparedEnvNeedsReplacement = true
+
+				break
+			}
+		}
+	}
+
 	return nil
 }
 
+// needReplacement checks if a string contains placeholdes.
+func needReplacement(s string) bool {
+	return strings.Contains(s, "{") || strings.Contains(s, "}")
+}
+
 // ServeHTTP implements caddyhttp.MiddlewareHandler.
 // TODO: Expose TLS versions as env vars, as Apache's mod_ssl: https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go#L298
 func (f FrankenPHPModule) ServeHTTP(w http.ResponseWriter, r *http.Request, _ caddyhttp.Handler) error {
 	origReq := r.Context().Value(caddyhttp.OriginalRequestCtxKey).(http.Request)
 	repl := r.Context().Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
 
-	documentRoot := repl.ReplaceKnown(f.Root, "")
+	var documentRootOption frankenphp.RequestOption
+	if f.resolvedDocumentRoot == "" {
+		documentRootOption = frankenphp.WithRequestDocumentRoot(repl.ReplaceKnown(f.Root, ""), *f.ResolveRootSymlink)
+	} else {
+		documentRootOption = frankenphp.WithRequestResolvedDocumentRoot(f.resolvedDocumentRoot)
+	}
 
-	env := make(map[string]string, len(f.Env)+1)
-	env["REQUEST_URI"] = origReq.URL.RequestURI()
-	for k, v := range f.Env {
-		env[k] = repl.ReplaceKnown(v, "")
+	env := make(map[string]string, len(f.preparedEnv)+1)
+	env["REQUEST_URI\x00"] = origReq.URL.RequestURI()
+	for k, v := range f.preparedEnv {
+		if f.preparedEnvNeedsReplacement {
+			env[k] = repl.ReplaceKnown(v, "")
+		} else {
+			env[k] = v
+		}
 	}
 
 	fr, err := frankenphp.NewRequestWithContext(
 		r,
-		frankenphp.WithRequestDocumentRoot(documentRoot, f.ResolveRootSymlink),
+		documentRootOption,
 		frankenphp.WithRequestSplitPath(f.SplitPath),
-		frankenphp.WithRequestEnv(env),
+		frankenphp.WithRequestPreparedEnv(env),
 	)
 
 	if err != nil {
@@ -293,14 +353,25 @@ func (f *FrankenPHPModule) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
 				}
 				if f.Env == nil {
 					f.Env = make(map[string]string)
+					f.preparedEnv = make(frankenphp.PreparedEnv)
 				}
 				f.Env[args[0]] = args[1]
+				f.preparedEnv[args[0]+"\x00"] = args[1]
 
 			case "resolve_root_symlink":
+				if !d.NextArg() {
+					continue
+				}
+
+				v, err := strconv.ParseBool(d.Val())
+				if err != nil {
+					return err
+				}
 				if d.NextArg() {
 					return d.ArgErr()
 				}
-				f.ResolveRootSymlink = true
+
+				f.ResolveRootSymlink = &v
 			}
 		}
 	}
@@ -444,7 +515,8 @@ func parsePhpServer(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error)
 		if phpsrv.Root == "" {
 			phpsrv.Root = filepath.Join(frankenphp.EmbeddedAppPath, defaultDocumentRoot)
 			fsrv.Root = phpsrv.Root
-			phpsrv.ResolveRootSymlink = false
+			rrs := false
+			phpsrv.ResolveRootSymlink = &rrs
 		} else if filepath.IsLocal(fsrv.Root) {
 			phpsrv.Root = filepath.Join(frankenphp.EmbeddedAppPath, phpsrv.Root)
 			fsrv.Root = phpsrv.Root

caddy/caddy_test.go

@@ -120,7 +120,7 @@ func TestEnv(t *testing.T) {
 
 			frankenphp {
 				worker {
-					file ../testdata/env.php
+					file ../testdata/worker-env.php
 					num 1
 					env FOO bar
 				}
@@ -137,7 +137,90 @@ func TestEnv(t *testing.T) {
 		}
 		`, "caddyfile")
 
-	tester.AssertGetResponse("http://localhost:9080/env.php", http.StatusOK, "bazbar")
+	tester.AssertGetResponse("http://localhost:9080/worker-env.php", http.StatusOK, "bazbar")
+}
+
+func TestJsonEnv(t *testing.T) {
+	tester := caddytest.NewTester(t)
+	tester.InitServer(`
+		{
+		"admin": {
+			"listen": "localhost:2999"
+		},
+		"apps": {
+			"frankenphp": {
+			"workers": [
+				{
+				"env": {
+					"FOO": "bar"
+				},
+				"file_name": "../testdata/worker-env.php",
+				"num": 1
+				}
+			]
+			},
+			"http": {
+			"http_port": 9080,
+			"https_port": 9443,
+			"servers": {
+				"srv0": {
+				"listen": [
+					":9080"
+				],
+				"routes": [
+					{
+					"handle": [
+						{
+						"handler": "subroute",
+						"routes": [
+							{
+							"handle": [
+								{
+								"handler": "subroute",
+								"routes": [
+									{
+									"handle": [
+										{
+										"env": {
+											"FOO": "baz"
+										},
+										"handler": "php",
+										"root": "../testdata"
+										}
+									]
+									}
+								]
+								}
+							]
+							}
+						]
+						}
+					],
+					"match": [
+						{
+						"host": [
+							"localhost"
+						]
+						}
+					],
+					"terminal": true
+					}
+				]
+				}
+			}
+			},
+			"pki": {
+			"certificate_authorities": {
+				"local": {
+				"install_trust": false
+				}
+			}
+			}
+		}
+		}
+		`, "json")
+
+	tester.AssertGetResponse("http://localhost:9080/worker-env.php", http.StatusOK, "bazbar")
 }
 
 func TestPHPServerDirective(t *testing.T) {
@@ -150,7 +233,6 @@ func TestPHPServerDirective(t *testing.T) {
 			https_port 9443
 
 			frankenphp
-			order php_server before reverse_proxy
 		}
 
 		localhost:9080 {

caddy/frankenphp/Caddyfile

@@ -5,12 +5,6 @@
 		#worker /path/to/your/worker.php
 		{$FRANKENPHP_CONFIG}
 	}
-
-	# https://caddyserver.com/docs/caddyfile/directives#sorting-algorithm
-	order mercure after encode
-	order vulcain after reverse_proxy
-	order php_server before file_server
-	order php before file_server
 }
 
 {$CADDY_EXTRA_CONFIG}
@@ -19,11 +13,8 @@
 	#log {
 	#	# Redact the authorization query parameter that can be set by Mercure
 	#	format filter {
-	#		wrap console
-	#		fields {
-	#			uri query {
-	#				replace authorization REDACTED
-	#			}
+	#		request>uri query {
+	#			replace authorization REDACTED
 	#		}
 	#	}
 	#}

caddy/frankenphp/main.go

@@ -1,10 +1,7 @@
 package main
 
 import (
-	"github.com/caddyserver/caddy/v2"
 	caddycmd "github.com/caddyserver/caddy/v2/cmd"
-	"go.uber.org/automaxprocs/maxprocs"
-	"go.uber.org/zap"
 
 	// plug in Caddy modules here.
 	_ "github.com/caddyserver/caddy/v2/modules/standard"
@@ -15,11 +12,5 @@ import (
 )
 
 func main() {
-	undo, err := maxprocs.Set()
-	defer undo()
-	if err != nil {
-		caddy.Log().Warn("failed to set GOMAXPROCS", zap.Error(err))
-	}
-
 	caddycmd.Main()
 }

caddy/go.mod

@@ -1,196 +1,200 @@
 module github.com/dunglas/frankenphp/caddy
 
-go 1.21
+go 1.22.0
 
 replace github.com/dunglas/frankenphp => ../
 
 retract v1.0.0-rc.1 // Human error
 
 require (
-	github.com/caddyserver/caddy/v2 v2.7.6
-	github.com/caddyserver/certmagic v0.20.0
+	github.com/caddyserver/caddy/v2 v2.8.4
+	github.com/caddyserver/certmagic v0.21.3
 	github.com/dunglas/caddy-cbrotli v1.0.0
-	github.com/dunglas/frankenphp v1.0.3
-	github.com/dunglas/mercure/caddy v0.15.9
-	github.com/dunglas/vulcain/caddy v1.0.1
-	github.com/spf13/cobra v1.8.0
-	go.uber.org/automaxprocs v1.5.3
-	go.uber.org/zap v1.26.0
+	github.com/dunglas/frankenphp v1.2.5
+	github.com/dunglas/mercure/caddy v0.16.3
+	github.com/dunglas/vulcain/caddy v1.0.5
+	github.com/spf13/cobra v1.8.1
+	go.uber.org/zap v1.27.0
 )
 
-require (
-	github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
-	github.com/micromdm/scep/v2 v2.1.0 // indirect
-	github.com/smallstep/go-attestation v0.4.4-0.20240109183208-413678f90935 // indirect
-	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
-)
+require github.com/smallstep/go-attestation v0.4.4-0.20240109183208-413678f90935 // indirect
 
 require (
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
-	github.com/BurntSushi/toml v1.3.2 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.2.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/MauriceGit/skiplist v0.0.0-20211105230623-77f5c8d3e145 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
-	github.com/RoaringBitmap/roaring v1.8.0 // indirect
-	github.com/alecthomas/chroma/v2 v2.12.0 // indirect
+	github.com/MicahParks/jwkset v0.5.18 // indirect
+	github.com/MicahParks/keyfunc/v3 v3.3.3 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/RoaringBitmap/roaring v1.9.4 // indirect
+	github.com/alecthomas/chroma/v2 v2.14.0 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bits-and-blooms/bitset v1.13.0 // indirect
+	github.com/bits-and-blooms/bitset v1.14.2 // indirect
+	github.com/caddyserver/zerossl v0.1.3 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
 	github.com/dgraph-io/badger v1.6.2 // indirect
 	github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
 	github.com/dgraph-io/ristretto v0.1.1 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
-	github.com/dlclark/regexp2 v1.10.0 // indirect
+	github.com/dlclark/regexp2 v1.11.4 // indirect
+	github.com/dolthub/maphash v0.1.0 // indirect
 	github.com/dunglas/httpsfv v1.0.2 // indirect
-	github.com/dunglas/mercure v0.15.9 // indirect
-	github.com/dunglas/vulcain v1.0.1 // indirect
+	github.com/dunglas/mercure v0.16.3 // indirect
+	github.com/dunglas/vulcain v1.0.5 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.5.0 // indirect
-	github.com/getkin/kin-openapi v0.122.0 // indirect
-	github.com/go-chi/chi/v5 v5.0.10 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/gammazero/deque v0.2.1 // indirect
+	github.com/getkin/kin-openapi v0.124.0 // indirect
+	github.com/go-chi/chi/v5 v5.1.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
 	github.com/go-kit/kit v0.13.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-logr/logr v1.3.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.5 // indirect
-	github.com/go-sql-driver/mysql v1.7.1 // indirect
-	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-sql-driver/mysql v1.8.1 // indirect
+	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gofrs/uuid v4.4.0+incompatible // indirect
-	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
-	github.com/golang/glog v1.2.0 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
+	github.com/golang/glog v1.2.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/brotli/go/cbrotli v0.0.0-20240116120200-adbc354d23af // indirect
-	github.com/google/cel-go v0.15.1 // indirect
-	github.com/google/certificate-transparency-go v1.1.7 // indirect
+	github.com/google/cel-go v0.21.0 // indirect
+	github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745 // indirect
 	github.com/google/go-tpm v0.9.0 // indirect
 	github.com/google/go-tspi v0.3.0 // indirect
-	github.com/google/pprof v0.0.0-20240125082051-42cd04596328 // indirect
+	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/huandu/xstrings v1.4.0 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/invopop/yaml v0.2.0 // indirect
-	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.1 // indirect
-	github.com/jackc/pgio v1.0.0 // indirect
+	github.com/invopop/yaml v0.3.1 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.2 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20231201235250-de7065d80cb9 // indirect
-	github.com/jackc/pgtype v1.14.1 // indirect
-	github.com/jackc/pgx/v4 v4.18.1 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgx/v5 v5.6.0 // indirect
+	github.com/jackc/puddle/v2 v2.2.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/kevburnsjr/skipfilter v0.0.1 // indirect
-	github.com/klauspost/compress v1.17.5 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
-	github.com/libdns/libdns v0.2.1 // indirect
+	github.com/klauspost/compress v1.17.9 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
+	github.com/libdns/libdns v0.2.2 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/manifoldco/promptui v0.9.0 // indirect
-	github.com/mastercactapus/proxyprotocol v0.0.4 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/maypok86/otter v1.2.2 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
-	github.com/mholt/acmez v1.2.0 // indirect
-	github.com/miekg/dns v1.1.58 // indirect
+	github.com/mholt/acmez/v2 v2.0.2 // indirect
+	github.com/miekg/dns v1.1.62 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
-	github.com/onsi/ginkgo/v2 v2.15.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.1.1 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/onsi/ginkgo/v2 v2.20.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
 	github.com/perimeterx/marshmallow v1.1.5 // indirect
+	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/client_golang v1.18.0 // indirect
-	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.46.0 // indirect
-	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/prometheus/client_golang v1.20.2 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.55.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/quic-go/qpack v0.4.0 // indirect
-	github.com/quic-go/quic-go v0.41.0 // indirect
-	github.com/rs/xid v1.5.0 // indirect
+	github.com/quic-go/quic-go v0.46.0 // indirect
+	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sagikazarmark/locafero v0.4.0 // indirect
+	github.com/sagikazarmark/locafero v0.6.0 // indirect
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
-	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/slackhq/nebula v1.8.2 // indirect
-	github.com/smallstep/certificates v0.25.0 // indirect
-	github.com/smallstep/nosql v0.6.0 // indirect
-	github.com/smallstep/truststore v0.12.1 // indirect
+	github.com/slackhq/nebula v1.9.3 // indirect
+	github.com/smallstep/certificates v0.27.2 // indirect
+	github.com/smallstep/nosql v0.7.0 // indirect
+	github.com/smallstep/pkcs7 v0.0.0-20240723090913-5e2c6a136dfa // indirect
+	github.com/smallstep/scep v0.0.0-20240214080410-892e41795b99 // indirect
+	github.com/smallstep/truststore v0.13.0 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/afero v1.11.0 // indirect
-	github.com/spf13/cast v1.6.0 // indirect
+	github.com/spf13/cast v1.7.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/spf13/viper v1.18.2 // indirect
+	github.com/spf13/viper v1.19.0 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046 // indirect
-	github.com/tidwall/gjson v1.17.0 // indirect
+	github.com/tailscale/tscert v0.0.0-20240608151842-d3f834017e53 // indirect
+	github.com/tidwall/gjson v1.17.1 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/unrolled/secure v1.14.0 // indirect
-	github.com/urfave/cli v1.22.14 // indirect
+	github.com/unrolled/secure v1.15.0 // indirect
+	github.com/urfave/cli v1.22.15 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
-	github.com/yuin/goldmark v1.6.0 // indirect
+	github.com/yuin/goldmark v1.7.4 // indirect
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc // indirect
-	github.com/zeebo/blake3 v0.2.3 // indirect
-	go.etcd.io/bbolt v1.3.8 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
+	github.com/zeebo/blake3 v0.2.4 // indirect
+	go.etcd.io/bbolt v1.3.11 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
 	go.opentelemetry.io/contrib/propagators/autoprop v0.45.0 // indirect
 	go.opentelemetry.io/contrib/propagators/aws v1.20.0 // indirect
 	go.opentelemetry.io/contrib/propagators/b3 v1.20.0 // indirect
 	go.opentelemetry.io/contrib/propagators/jaeger v1.20.0 // indirect
 	go.opentelemetry.io/contrib/propagators/ot v1.20.0 // indirect
-	go.opentelemetry.io/otel v1.21.0 // indirect
+	go.opentelemetry.io/otel v1.24.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
-	go.opentelemetry.io/otel/metric v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.24.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.21.0 // indirect
-	go.opentelemetry.io/otel/trace v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
-	go.step.sm/cli-utils v0.8.0 // indirect
-	go.step.sm/crypto v0.36.0 // indirect
-	go.step.sm/linkedca v0.20.1 // indirect
+	go.step.sm/cli-utils v0.9.0 // indirect
+	go.step.sm/crypto v0.51.1 // indirect
+	go.step.sm/linkedca v0.22.1 // indirect
+	go.uber.org/automaxprocs v1.5.3 // indirect
 	go.uber.org/mock v0.4.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.18.0 // indirect
-	golang.org/x/exp v0.0.0-20240119083558-1b970713d09a // indirect
-	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.20.0 // indirect
-	golang.org/x/sync v0.6.0 // indirect
-	golang.org/x/sys v0.16.0 // indirect
-	golang.org/x/term v0.16.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/tools v0.17.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/grpc v1.61.0 // indirect
-	google.golang.org/protobuf v1.32.0 // indirect
+	go.uber.org/zap/exp v0.2.0 // indirect
+	golang.org/x/crypto v0.26.0 // indirect
+	golang.org/x/crypto/x509roots/fallback v0.0.0-20240806160748-b2d3a6a4b4d3 // indirect
+	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
+	golang.org/x/mod v0.20.0 // indirect
+	golang.org/x/net v0.28.0 // indirect
+	golang.org/x/sync v0.8.0 // indirect
+	golang.org/x/sys v0.24.0 // indirect
+	golang.org/x/term v0.23.0 // indirect
+	golang.org/x/text v0.17.0 // indirect
+	golang.org/x/time v0.6.0 // indirect
+	golang.org/x/tools v0.24.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7 // indirect
+	google.golang.org/grpc v1.65.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	howett.net/plist v1.0.1 // indirect
 )

caddy/go.sum

@@ -1,22 +1,28 @@
-cloud.google.com/go v0.110.10 h1:LXy9GEO+timppncPIAZoOj3l58LIU9k+kn48AN7IO3Y=
-cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
-cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
-cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
-cloud.google.com/go/kms v1.15.2 h1:lh6qra6oC4AyWe5fUUUBe/S27k12OHAleOOOw6KakdE=
-cloud.google.com/go/kms v1.15.2/go.mod h1:3hopT4+7ooWRCjc2DxgnpESFxhIraaI2IpAVUEhbT/w=
+cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
+cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
+cloud.google.com/go/auth v0.7.2 h1:uiha352VrCDMXg+yoBtaD0tUF4Kv9vrtrWPYXwutnDE=
+cloud.google.com/go/auth v0.7.2/go.mod h1:VEc4p5NNxycWQTMQEDQF0bd6aTMb6VgYDXEwiJJQAbs=
+cloud.google.com/go/auth/oauth2adapt v0.2.3 h1:MlxF+Pd3OmSudg/b1yZ5lJwoXCEaeedAguodky1PcKI=
+cloud.google.com/go/auth/oauth2adapt v0.2.3/go.mod h1:tMQXOfZzFuNuUxOypHlQEXgdfX5cuhwU+ffUuXRJE8I=
+cloud.google.com/go/compute v1.24.0 h1:phWcR2eWzRJaL/kOiJwfFsPs4BaKq1j6vnpZrc1YlVg=
+cloud.google.com/go/compute/metadata v0.5.0 h1:Zr0eK8JbFv6+Wi4ilXAR8FJ3wyNdpxHKJNPos6LTZOY=
+cloud.google.com/go/compute/metadata v0.5.0/go.mod h1:aHnloV2TPI38yx4s9+wAZhHykWvVCfu7hQbF+9CWoiY=
+cloud.google.com/go/iam v1.1.10 h1:ZSAr64oEhQSClwBL670MsJAW5/RLiC6kfw3Bqmd5ZDI=
+cloud.google.com/go/iam v1.1.10/go.mod h1:iEgMq62sg8zx446GCaijmA2Miwg5o3UbO+nI47WHJps=
+cloud.google.com/go/kms v1.18.3 h1:8+Z2S4bQDSCdghB5ZA5dVDDJTLmnkRlowtFiXqMFd74=
+cloud.google.com/go/kms v1.18.3/go.mod h1:y/Lcf6fyhbdn7MrG1VaDqXxM8rhOBc5rWcWAhcvZjQU=
+cloud.google.com/go/longrunning v0.5.9 h1:haH9pAuXdPAMqHvzX0zlWQigXT7B0+CL4/2nXXdBo5k=
+cloud.google.com/go/longrunning v0.5.9/go.mod h1:HD+0l9/OOW0za6UWdKJtXoFAX/BGg/3Wj8p10NeWF7c=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 h1:cTp8I5+VIoKjsnZuH8vjyaysT/ses3EvZeaV/1UkF2M=
 github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
 github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
+github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
 github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
@@ -25,47 +31,78 @@ github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBa
 github.com/MauriceGit/skiplist v0.0.0-20191117202105-643e379adb62/go.mod h1:877WBceefKn14QwVVn4xRFUsHsZb9clICgdeTj4XsUg=
 github.com/MauriceGit/skiplist v0.0.0-20211105230623-77f5c8d3e145 h1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=
 github.com/MauriceGit/skiplist v0.0.0-20211105230623-77f5c8d3e145/go.mod h1:877WBceefKn14QwVVn4xRFUsHsZb9clICgdeTj4XsUg=
+github.com/MicahParks/jwkset v0.5.18 h1:WLdyMngF7rCrnstQxA7mpRoxeaWqGzPM/0z40PJUK4w=
+github.com/MicahParks/jwkset v0.5.18/go.mod h1:q8ptTGn/Z9c4MwbcfeCDssADeVQb3Pk7PnVxrvi+2QY=
+github.com/MicahParks/keyfunc/v3 v3.3.3 h1:c6j9oSu1YUo0k//KwF1miIQlEMtqNlj7XBFLB8jtEmY=
+github.com/MicahParks/keyfunc/v3 v3.3.3/go.mod h1:f/UMyXdKfkZzmBeBFUeYk+zu066J1Fcl48f7Wnl5Z48=
 github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
-github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
-github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/RoaringBitmap/roaring v0.9.4/go.mod h1:icnadbWcNyfEHlYdr+tDlOTih1Bf/h+rzPpv4sbomAA=
-github.com/RoaringBitmap/roaring v1.8.0 h1:h3Tbzc/4K7sW3sRMlBdOIW77x9rikkqvOgU/j+ofkn0=
-github.com/RoaringBitmap/roaring v1.8.0/go.mod h1:6AXUsoIEzDTFFQCe1RbGA6uFONMhvejWj5rqITANK90=
-github.com/alecthomas/assert/v2 v2.2.1 h1:XivOgYcduV98QCahG8T5XTezV5bylXe+lBxLG2K2ink=
-github.com/alecthomas/assert/v2 v2.2.1/go.mod h1:pXcQ2Asjp247dahGEmsZ6ru0UVwnkhktn7S0bBDLxvQ=
+github.com/RoaringBitmap/roaring v1.9.4 h1:yhEIoH4YezLYT04s1nHehNO64EKFTop/wBhxv2QzDdQ=
+github.com/RoaringBitmap/roaring v1.9.4/go.mod h1:6AXUsoIEzDTFFQCe1RbGA6uFONMhvejWj5rqITANK90=
+github.com/alecthomas/assert/v2 v2.7.0 h1:QtqSACNS3tF7oasA8CU6A6sXZSBDqnm7RfpLl9bZqbE=
+github.com/alecthomas/assert/v2 v2.7.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
-github.com/alecthomas/chroma/v2 v2.12.0 h1:Wh8qLEgMMsN7mgyG8/qIpegky2Hvzr4By6gEF7cmWgw=
-github.com/alecthomas/chroma/v2 v2.12.0/go.mod h1:4TQu7gdfuPjSh76j78ietmqh9LiurGF0EpseFXdKMBw=
+github.com/alecthomas/chroma/v2 v2.14.0 h1:R3+wzpnUArGcQz7fCETQBzO5n9IMNi13iIs46aU4V9E=
+github.com/alecthomas/chroma/v2 v2.14.0/go.mod h1:QolEbTfmUHIMVpBqxeDnNBj2uoeI4EbYP4i6n68SG4I=
 github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
-github.com/alecthomas/repr v0.2.0 h1:HAzS41CIzNW5syS8Mf9UwXhNH1J9aix/BvDRf1Ml2Yk=
-github.com/alecthomas/repr v0.2.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df h1:7RFfzj4SSt6nnvCPbCqijJi1nWCd+TqAT3bYCStRC18=
-github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df/go.mod h1:pSwJ0fSY5KhvocuWSx4fz3BA8OrA1bQn+K1Eli3BRwM=
+github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
+github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b h1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=
 github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b/go.mod h1:DAHtR1m6lCRdSC2Tm3DSWRPvIPr6xNKyeHdqDQSQT+A=
-github.com/aws/aws-sdk-go v1.46.4 h1:48tKgtm9VMPkb6y7HuYlsfhQmoIRAsTEXTsWLVlty4M=
-github.com/aws/aws-sdk-go v1.46.4/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go-v2 v1.30.3 h1:jUeBtG0Ih+ZIFH0F4UkmL9w3cSpaMv9tYYDbzILP8dY=
+github.com/aws/aws-sdk-go-v2 v1.30.3/go.mod h1:nIQjQVp5sfpQcTc9mPSr1B0PaWK5ByX9MOoDadSN4lc=
+github.com/aws/aws-sdk-go-v2/config v1.27.27 h1:HdqgGt1OAP0HkEDDShEl0oSYa9ZZBSOmKpdpsDMdO90=
+github.com/aws/aws-sdk-go-v2/config v1.27.27/go.mod h1:MVYamCg76dFNINkZFu4n4RjDixhVr51HLj4ErWzrVwg=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.27 h1:2raNba6gr2IfA0eqqiP2XiQ0UVOpGPgDSi0I9iAP+UI=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.27/go.mod h1:gniiwbGahQByxan6YjQUMcW4Aov6bLC3m+evgcoN4r4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 h1:KreluoV8FZDEtI6Co2xuNk/UqI9iwMrOx/87PBNIKqw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11/go.mod h1:SeSUYBLsMYFoRvHE0Tjvn7kbxaUhl75CJi1sbfhMxkU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 h1:SoNJ4RlFEQEbtDcCEt+QG56MY4fm4W8rYirAmq+/DdU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15/go.mod h1:U9ke74k1n2bf+RIgoX1SXFed1HLs51OgUSs+Ph0KJP8=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 h1:C6WHdGnTDIYETAm5iErQUiVNsclNx9qbJVPIt03B6bI=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15/go.mod h1:ZQLZqhcu+JhSrA9/NXRm8SkDvsycE+JkV3WGY41e+IM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 h1:dT3MqvGhSoaIhRseqw2I0yH81l7wiR2vjs57O51EAm8=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3/go.mod h1:GlAeCkHwugxdHaueRr4nhPuY+WW+gR8UjlcqzPr1SPI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 h1:HGErhhrxZlQ044RiM+WdoZxp0p+EGM62y3L6pwA4olE=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17/go.mod h1:RkZEx4l0EHYDJpWppMJ3nD9wZJAa8/0lq9aVC+r2UII=
+github.com/aws/aws-sdk-go-v2/service/kms v1.35.3 h1:UPTdlTOwWUX49fVi7cymEN6hDqCwe3LNv1vi7TXUutk=
+github.com/aws/aws-sdk-go-v2/service/kms v1.35.3/go.mod h1:gjDP16zn+WWalyaUqwCCioQ8gU8lzttCCc9jYsiQI/8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 h1:BXx0ZIxvrJdSgSvKTZ+yRBeSqqgPM89VPlulEcl37tM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.22.4/go.mod h1:ooyCOXjvJEsUw7x+ZDHeISPMhtwI3ZCB7ggFMcFfWLU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 h1:yiwVzJW2ZxZTurVbYWA7QOrAaCYQR72t0wrSBfoesUE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4/go.mod h1:0oxfLkpz3rQ/CHlx5hB7H69YUpFiI1tql6Q6Ne+1bCw=
+github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 h1:ZsDKRLXGWHk8WdtyYMoGNO7bTudrvuKpDKgMVRlepGE=
+github.com/aws/aws-sdk-go-v2/service/sts v1.30.3/go.mod h1:zwySh8fpFyXp9yOr/KVzxOl8SRqgf/IDw5aUt9UKFcQ=
+github.com/aws/smithy-go v1.20.3 h1:ryHwveWzPV5BIof6fyDvor6V3iUL7nTfiTKXHiW05nE=
+github.com/aws/smithy-go v1.20.3/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
 github.com/bits-and-blooms/bitset v1.12.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
-github.com/bits-and-blooms/bitset v1.13.0 h1:bAQ9OPNFYbGHV6Nez0tmNI0RiEu7/hxlYJRUA0wFAVE=
-github.com/bits-and-blooms/bitset v1.13.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
-github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
-github.com/caddyserver/caddy/v2 v2.7.6 h1:w0NymbG2m9PcvKWsrXO6EEkY9Ru4FJK8uQbYcev1p3A=
-github.com/caddyserver/caddy/v2 v2.7.6/go.mod h1:JCiwFMnRWjk8lOa7po0wM/75kwd38ccJPMSrXvQCMQ0=
-github.com/caddyserver/certmagic v0.20.0 h1:bTw7LcEZAh9ucYCRXyCpIrSAGplplI0vGYJ4BpCQ/Fc=
-github.com/caddyserver/certmagic v0.20.0/go.mod h1:N4sXgpICQUskEWpj7zVzvWD41p3NYacrNoZYiRM2jTg=
+github.com/bits-and-blooms/bitset v1.14.2 h1:YXVoyPndbdvcEVcseEovVfp0qjJp7S+i5+xgp/Nfbdc=
+github.com/bits-and-blooms/bitset v1.14.2/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
+github.com/caddyserver/caddy/v2 v2.8.4 h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=
+github.com/caddyserver/caddy/v2 v2.8.4/go.mod h1:vmDAHp3d05JIvuhc24LmnxVlsZmWnUwbP5WMjzcMPWw=
+github.com/caddyserver/certmagic v0.21.3 h1:pqRRry3yuB4CWBVq9+cUqu+Y6E2z8TswbhNx1AZeYm0=
+github.com/caddyserver/certmagic v0.21.3/go.mod h1:Zq6pklO9nVRl3DIFUw9gVUfXKdpc/0qwTUAQMBlfgtI=
+github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
+github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/logex v1.2.1 h1:XHDu3E6q+gdHgsdTPH6ImJMIp436vR6MPtH8gP05QzM=
 github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ=
@@ -75,18 +112,12 @@ github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObk
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
 github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
-github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
-github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -104,20 +135,22 @@ github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 h1:fAjc9m62+UWV/WA
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2 v1.10.0 h1:+/GIL799phkJqYW+3YbOd8LCcbHzT0Pbo8zl70MHsq0=
-github.com/dlclark/regexp2 v1.10.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
+github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dolthub/maphash v0.1.0 h1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L/QxPDyQ=
+github.com/dolthub/maphash v0.1.0/go.mod h1:gkg4Ch4CdCDu5h6PMriVLawB7koZ+5ijb9puGMV50a4=
 github.com/dunglas/caddy-cbrotli v1.0.0 h1:+WNqXBkWyMcIpXB2rVZ3nwcElUbuAzf0kPxNXU4D+u0=
 github.com/dunglas/caddy-cbrotli v1.0.0/go.mod h1:KZsUu3fnQBgO0o3YDoQuO3Z61dFgUncr1F8rg8acwQw=
 github.com/dunglas/httpsfv v1.0.2 h1:iERDp/YAfnojSDJ7PW3dj1AReJz4MrwbECSSE59JWL0=
 github.com/dunglas/httpsfv v1.0.2/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
-github.com/dunglas/mercure v0.15.9 h1:Jdbi4jwzfIkZCcDX54W5C21S4kQX2AszfcoOAnSLZPw=
-github.com/dunglas/mercure v0.15.9/go.mod h1:1CY1/D2sZ3RxLWCcAODowg/2yINbiG7IJf2fJCFDj3A=
-github.com/dunglas/mercure/caddy v0.15.9 h1:YqHNSZ6XKKQsK2jiMkttOIkaq80e0lC8rnOXaV/bhxQ=
-github.com/dunglas/mercure/caddy v0.15.9/go.mod h1:cM+991N0bpMw4R/79DM4dCEtbyyikHfZfwDOiCF/qx4=
-github.com/dunglas/vulcain v1.0.1 h1:S6bJYYwb8q7BlyQwYqHio0lyPYfBUvzY2dB3WlZXELU=
-github.com/dunglas/vulcain v1.0.1/go.mod h1:i209S5QmwiSpsxj/nqTsDAd7TP7OyG4MrsEX0jqAF1o=
-github.com/dunglas/vulcain/caddy v1.0.1 h1:wso79xuGcxgrxsCCYeGiurfNz/N20jI8JHjPWuu2BPU=
-github.com/dunglas/vulcain/caddy v1.0.1/go.mod h1:haPwAQt1G5+O/+zIcwvD+02CkBNGHbxtTvNfUHP0o0w=
+github.com/dunglas/mercure v0.16.3 h1:zDEBFpvV61SlJnJYhFM87GKB4c2F4zdOKfs/xnrw/7Y=
+github.com/dunglas/mercure v0.16.3/go.mod h1:hjqBKhcZDPMwa3oeOL5jQOghUgBl5bBiArQQTz9KX1M=
+github.com/dunglas/mercure/caddy v0.16.3 h1:/xRZmM48kmaXtsjW1w0IAwoKlsqrQqi3oDKcMoz2i2s=
+github.com/dunglas/mercure/caddy v0.16.3/go.mod h1:uwjaRLR3FnePFB8KmqxzcL696PYBXNvR7k/DpGepMRA=
+github.com/dunglas/vulcain v1.0.5 h1:oWZFD5d2NQL5HdTvE5ZDlWzLTAjN3yyxHha5TMrLtCU=
+github.com/dunglas/vulcain v1.0.5/go.mod h1:IgSv0R4mqNmJtfinnl9TcRGHqsPaBFesT5TSvY4PTY0=
+github.com/dunglas/vulcain/caddy v1.0.5 h1:GOkyqoOu3uTnOSnFXMKgHU+jL1D/BXSzVfoQM5MnQOI=
+github.com/dunglas/vulcain/caddy v1.0.5/go.mod h1:44+4e7q60jhdNqud8Ms4j+xb43pIU2jeTplKhMry9bo=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
@@ -128,53 +161,52 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/fxamacker/cbor/v2 v2.5.0 h1:oHsG0V/Q6E/wqTS2O1Cozzsy69nqCiguo5Q1a1ADivE=
-github.com/fxamacker/cbor/v2 v2.5.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
-github.com/getkin/kin-openapi v0.122.0 h1:WB9Jbl0Hp/T79/JF9xlSW5Kl9uYdk/AWD0yAd9HOM10=
-github.com/getkin/kin-openapi v0.122.0/go.mod h1:PCWw/lfBrJY4HcdqE3jj+QFkaFK8ABoqo7PvqVhXXqw=
-github.com/go-chi/chi/v5 v5.0.10 h1:rLz5avzKpjqxrYwXNfmjkrYYXOyLJd37pz53UFHC6vk=
-github.com/go-chi/chi/v5 v5.0.10/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/gammazero/deque v0.2.1 h1:qSdsbG6pgp6nL7A0+K/B7s12mcCY/5l5SIUpMOl+dC0=
+github.com/gammazero/deque v0.2.1/go.mod h1:LFroj8x4cMYCukHJDbxFCkT+r9AndaJnFMuZDV34tuU=
+github.com/getkin/kin-openapi v0.124.0 h1:VSFNMB9C9rTKBnQ/fpyDU8ytMTr4dWI9QovSKj9kz/M=
+github.com/getkin/kin-openapi v0.124.0/go.mod h1:wb1aSZA/iWmorQP9KTAS/phLj/t17B5jT7+fS8ed9NM=
+github.com/go-chi/chi/v5 v5.1.0 h1:acVI1TYaD+hhedDJ3r54HyA6sExp3HfXq7QWEEY/xMw=
+github.com/go-chi/chi/v5 v5.1.0/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
+github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
 github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.13.0 h1:OoneCcHKHQ03LfBpoQCUfCluwd2Vt3ohz+kvbJneZAU=
 github.com/go-kit/kit v0.13.0/go.mod h1:phqEHMMUbyrCFCTgH48JueqrM3md2HcAZ8N3XE4FKDg=
-github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=
 github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
 github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
-github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/jsonpointer v0.20.2 h1:mQc3nmndL8ZBzStEo3JYF8wzmeWffDH4VbXz58sAx6Q=
-github.com/go-openapi/jsonpointer v0.20.2/go.mod h1:bHen+N0u1KEO3YlmqOjTT9Adn1RfD91Ar825/PuiRVs=
-github.com/go-openapi/swag v0.22.5 h1:fVS63IE3M0lsuWRzuom3RLwUMVI2peDH01s6M70ugys=
-github.com/go-openapi/swag v0.22.5/go.mod h1:Gl91UqO+btAM0plGGxHqJcQZ1ZTy6jbmridBTsDy8A0=
-github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
-github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
 github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
-github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
-github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/golang/glog v1.2.2 h1:1+mZ9upx1Dh6FmUTFR1naJ77miKiXgALjWOZ3NVFPmY=
+github.com/golang/glog v1.2.2/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
@@ -182,23 +214,22 @@ github.com/google/brotli/go/cbrotli v0.0.0-20240116120200-adbc354d23af h1:u7V797
 github.com/google/brotli/go/cbrotli v0.0.0-20240116120200-adbc354d23af/go.mod h1:nOPhAkwVliJdNTkj3gXpljmWhjc4wCaVqbMJcPKWP4s=
 github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
 github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.15.1 h1:iTgVZor2x9okXtmTrqO8cg4uvqIeaBcWhXtruaWFMYQ=
-github.com/google/cel-go v0.15.1/go.mod h1:YzWEoI07MC/a/wj9in8GeVatqfypkldgBlwXh9bCwqY=
+github.com/google/cel-go v0.21.0 h1:cl6uW/gxN+Hy50tNYvI691+sXxioCnstFzLp2WO4GCI=
+github.com/google/cel-go v0.21.0/go.mod h1:rHUlWCcBKgyEk+eV03RPdZUekPp6YcJwV0FxuUksYxc=
 github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
-github.com/google/certificate-transparency-go v1.1.7 h1:IASD+NtgSTJLPdzkthwvAG1ZVbF2WtFg4IvoA68XGSw=
-github.com/google/certificate-transparency-go v1.1.7/go.mod h1:FSSBo8fyMVgqptbfF6j5p/XNdgQftAhSmXcIxV9iphE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745 h1:heyoXNxkRT155x4jTAiSv5BVSVkueifPUm+Q8LUXMRo=
+github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745/go.mod h1:zN0wUQgV9LjwLZeFHnrAbQi8hzMVvEWePyk+MhPOk7k=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-tpm v0.9.0 h1:sQF6YqWMi+SCXpsmS3fd21oPy/vSddwZry4JnmltHVk=
 github.com/google/go-tpm v0.9.0/go.mod h1:FkNVkc6C+IsvDI9Jw1OveJmxGZUUaKxtrpOS47QWKfU=
-github.com/google/go-tpm-tools v0.4.1 h1:gYU6iwRo0tY3V6NDnS6m+XYog+b3g6YFhHQl3sYaUL4=
-github.com/google/go-tpm-tools v0.4.1/go.mod h1:w03m0jynhTo7puXTYoyfpNOMqyQ9SB7sixnKWsS/1L0=
+github.com/google/go-tpm-tools v0.4.4 h1:oiQfAIkc6xTy9Fl5NKTeTJkBTlXdHsxAofmQyxBKY98=
+github.com/google/go-tpm-tools v0.4.4/go.mod h1:T8jXkp2s+eltnCDIsXR84/MTcVU9Ja7bh3Mit0pa4AY=
 github.com/google/go-tspi v0.3.0 h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
 github.com/google/go-tspi v0.3.0/go.mod h1:xfMGI3G0PhxCdNVcYr1C4C+EizojDg/TXuX5by8CiHI=
-github.com/google/pprof v0.0.0-20240125082051-42cd04596328 h1:oI+lCI2DY1BsRrdzMJBhIMxBBdlZJl31YNQC11EiyvA=
-github.com/google/pprof v0.0.0-20240125082051-42cd04596328/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
+github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
 github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -206,15 +237,12 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
-github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
-github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
-github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/googleapis/gax-go/v2 v2.13.0 h1:yitjD5f7jQHhyDsnhKEBU52NdvvdSeGzlAnDPT0hH1s=
+github.com/googleapis/gax-go/v2 v2.13.0/go.mod h1:Z/fvTZXF8/uw7Xu5GuslPw+bplx6SS338j1Is2S+B7A=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
 github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
-github.com/gorilla/mux v1.4.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
-github.com/groob/finalizer v0.0.0-20170707115354-4c2ed49aabda/go.mod h1:MyndkAZd5rUMdNogn35MWXBX1UiBigrU8eTj8DoAC2c=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 h1:6UKoz5ujsI55KNpsJH3UwCq3T8kKbZwNZBNPuTTje8U=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1/go.mod h1:YvJ2f6MplWDhfxiUC3KpyTy76kYUZA4W3pTv/wdKQ9Y=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
@@ -225,101 +253,46 @@ github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
-github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
+github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/invopop/yaml v0.2.0 h1:7zky/qH+O0DwAyoobXUqvVBwgBFRxKoQ/3FjcVpjTMY=
-github.com/invopop/yaml v0.2.0/go.mod h1:2XuRLgs/ouIrW3XNzuNj7J3Nvu/Dig5MXvbCEdiBN3Q=
-github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
-github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
-github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
-github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
-github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
-github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
-github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
-github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
-github.com/jackc/pgconn v1.14.0/go.mod h1:9mBNlny0UvkgJdCDvdVHYSjI+8tD2rnKK69Wz8ti++E=
-github.com/jackc/pgconn v1.14.1 h1:smbxIaZA08n6YuxEX1sDyjV/qkbtUtkH20qLkR9MUR4=
-github.com/jackc/pgconn v1.14.1/go.mod h1:9mBNlny0UvkgJdCDvdVHYSjI+8tD2rnKK69Wz8ti++E=
-github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
-github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
-github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
-github.com/jackc/pgmock v0.0.0-20201204152224-4fe30f7445fd/go.mod h1:hrBW0Enj2AZTNpt/7Y5rr2xe/9Mn757Wtb2xeBzPv2c=
-github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65 h1:DadwsjnMwFjfWc9y5Wi/+Zz7xoE5ALHsRQlOctkOiHc=
-github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
+github.com/invopop/yaml v0.3.1 h1:f0+ZpmhfBSS4MhG+4HYseMdJhoeeopbSKbq5Rpeelso=
+github.com/invopop/yaml v0.3.1/go.mod h1:PMOp3nn4/12yEZUFfmOuNHJsZToEEOwoWsT+D81KkeA=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
-github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
-github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
-github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
-github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
-github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.3.2 h1:7eY55bdBeCz1F2fTzSz69QC+pG46jYq9/jtSPiJ5nn0=
-github.com/jackc/pgproto3/v2 v2.3.2/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgservicefile v0.0.0-20231201235250-de7065d80cb9 h1:L0QtFUgDarD7Fpv9jeVMgy/+Ec0mtnmYuImjTz6dtDA=
-github.com/jackc/pgservicefile v0.0.0-20231201235250-de7065d80cb9/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
-github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
-github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
-github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
-github.com/jackc/pgtype v1.14.1 h1:LyDar7M2K0tShCWqzJ/ctzF1QC3Wzc9c8a6cHE0PFdc=
-github.com/jackc/pgtype v1.14.1/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
-github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
-github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
-github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
-github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
-github.com/jackc/pgx/v4 v4.18.1 h1:YP7G1KABtKpB5IHrO9vYwSrCOhs7p3uqhvhhQBptya0=
-github.com/jackc/pgx/v4 v4.18.1/go.mod h1:FydWkUyadDmdNH/mHnGob881GawxeEm7TcMCzkb+qQE=
-github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
+github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
+github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
+github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kevburnsjr/skipfilter v0.0.1 h1:EWl1lWUJfIehrKYIEkps0Cl67lCfS2pUM9iZFNajp7g=
 github.com/kevburnsjr/skipfilter v0.0.1/go.mod h1:jfaRyFOYVUtIa6IIC+0mB1qiZqhHw+DKvFowCBuijSk=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.17.5 h1:d4vBd+7CHydUqpFBgUEKkSdtSugf9YFmSkvUYPquI5E=
-github.com/klauspost/compress v1.17.5/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
-github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/48xc=
-github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
+github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/cpuid/v2 v2.2.8 h1:+StwCXwm9PdpiEkPyzBXIy+M9KUb4ODm0Zarf1kS5BM=
+github.com/klauspost/cpuid/v2 v2.2.8/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
-github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/libdns/libdns v0.2.1 h1:Wu59T7wSHRgtA0cfxC+n1c/e+O3upJGWytknkmFEDis=
-github.com/libdns/libdns v0.2.1/go.mod h1:yQCXzk1lEZmmCPa857bnk4TsOiqYasqpyOEeSObbb40=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/libdns/libdns v0.2.2 h1:O6ws7bAfRPaBsgAYt8MDe2HcNBGC29hkZ9MX2eUSX3s=
+github.com/libdns/libdns v0.2.2/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
@@ -327,26 +300,19 @@ github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
 github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg=
-github.com/mastercactapus/proxyprotocol v0.0.4 h1:qSY75IZF30ZqIU9iW1ip3I7gTnm8wRAnGWqPxCBVgq0=
-github.com/mastercactapus/proxyprotocol v0.0.4/go.mod h1:X8FRVEDZz9FkrIoL4QYTBF4Ka4ELwTv0sah0/5NxCPw=
-github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/maypok86/otter v1.2.2 h1:jJi0y8ruR/ZcKmJ4FbQj3QQTqKwV+LNrSOo2S1zbF5M=
+github.com/maypok86/otter v1.2.2/go.mod h1:mKLfoI7v1HOmQMwFgX4QkRk23mX6ge3RDvjdHOWG4R4=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/mholt/acmez v1.2.0 h1:1hhLxSgY5FvH5HCnGUuwbKY2VQVo8IU7rxXKSnZ7F30=
-github.com/mholt/acmez v1.2.0/go.mod h1:VT9YwH1xgNX1kmYY89gY8xPJC84BFAisjo8Egigt4kE=
-github.com/micromdm/scep/v2 v2.1.0 h1:2fS9Rla7qRR266hvUoEauBJ7J6FhgssEiq2OkSKXmaU=
-github.com/micromdm/scep/v2 v2.1.0/go.mod h1:BkF7TkPPhmgJAMtHfP+sFTKXmgzNJgLQlvvGoOExBcc=
-github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
-github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
+github.com/mholt/acmez/v2 v2.0.2 h1:OmK6xckte2JfKGPz4OAA8aNHTiLvGp8tLzmrd/wfSyw=
+github.com/mholt/acmez/v2 v2.0.2/go.mod h1:fX4c9r5jYwMyMsC+7tkYRxHibkOTgta5DIFGoe67e1U=
+github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
+github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
@@ -363,18 +329,21 @@ github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
 github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
-github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY=
-github.com/onsi/ginkgo/v2 v2.15.0/go.mod h1:HlxMHtYF57y6Dpf+mc5529KKmSq9h2FpCF+/ZkwUxKM=
-github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
-github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/onsi/ginkgo/v2 v2.20.1 h1:YlVIbqct+ZmnEph770q9Q7NVAz4wwIiVNahee6JyUzo=
+github.com/onsi/ginkgo/v2 v2.20.1/go.mod h1:lG9ey2Z29hR41WMVthyJBGUBcBhGOtoPF2VFMvBXFCI=
+github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
+github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml/v2 v2.1.1 h1:LWAJwfNvjQZCFIDKWYQaM62NcYeYViCmWIwmOStowAI=
-github.com/pelletier/go-toml/v2 v2.1.1/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
+github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
+github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
 github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
 github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
 github.com/peterbourgon/diskv/v3 v3.0.1 h1:x06SQA46+PKIUftmEujdwSEpIx8kR+M9eLYsUxeYveU=
 github.com/peterbourgon/diskv/v3 v3.0.1/go.mod h1:kJ5Ny7vLdARGU3WUuy6uzO6T0nb/2gWcT1JiBvRmb5o=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pires/go-proxyproto v0.7.0 h1:IukmRewDQFWC7kfnb66CSomk2q/seBuilHBYFwyq0Hs=
+github.com/pires/go-proxyproto v0.7.0/go.mod h1:Vz/1JPY/OACxWGQNIRY2BeyDmpoaWmEP40O9LbuiFR4=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -383,59 +352,56 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
-github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
-github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
-github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
-github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
-github.com/prometheus/common v0.46.0 h1:doXzt5ybi1HBKpsZOL0sSkaNHJJqkyfEWZGGqqScV0Y=
-github.com/prometheus/common v0.46.0/go.mod h1:Tp0qkxpb9Jsg54QMe+EAmqXkSV7Evdy1BTn+g2pa/hQ=
-github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/prometheus/client_golang v1.20.2 h1:5ctymQzZlyOON1666svgwn3s6IKWgfbjsejTMiXIyjg=
+github.com/prometheus/client_golang v1.20.2/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
+github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=
 github.com/quic-go/qpack v0.4.0/go.mod h1:UZVnYIfi5GRk+zI9UMaCPsmZ2xKJP7XBUvVyT1Knj9A=
-github.com/quic-go/quic-go v0.41.0 h1:aD8MmHfgqTURWNJy48IYFg2OnxwHT3JL7ahGs73lb4k=
-github.com/quic-go/quic-go v0.41.0/go.mod h1:qCkNjqczPEvgsOnxZ0eCD14lv+B2LHlFAB++CNOh9hA=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
-github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
-github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
-github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
-github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
+github.com/quic-go/quic-go v0.46.0 h1:uuwLClEEyk1DNvchH8uCByQVjo3yKL9opKulExNDs7Y=
+github.com/quic-go/quic-go v0.46.0/go.mod h1:1dLehS7TIR64+vxGR70GDcatWTOtMX2PUtnKsjbTurI=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
-github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
+github.com/sagikazarmark/locafero v0.6.0 h1:ON7AQg37yzcRPU69mt7gwhFEBwxI6P9T4Qu3N51bwOk=
+github.com/sagikazarmark/locafero v0.6.0/go.mod h1:77OmuIc6VTraTXKXIs/uvUxKGUXjE1GbemJYHqdNjX0=
 github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
 github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
-github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/schollz/jsonstore v1.1.0 h1:WZBDjgezFS34CHI+myb4s8GGpir3UMpy7vWoCeO0n6E=
 github.com/schollz/jsonstore v1.1.0/go.mod h1:15c6+9guw8vDRyozGjN3FoILt0wpruJk9Pi66vjaZfg=
-github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
-github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/slackhq/nebula v1.8.2 h1:9lpJlivzjBPWxs9Y2tQqmJ1cP6hq+3kIodw021t3LrQ=
-github.com/slackhq/nebula v1.8.2/go.mod h1:SVVwnlGdmLg387U0XQMOSHRrD3VlJeXqd2/x/w/vxPs=
+github.com/slackhq/nebula v1.9.3 h1:WK5Oipy4NsVfNm41pywGmdy048F8RRkfSRG+lPHxcJQ=
+github.com/slackhq/nebula v1.9.3/go.mod h1:PMJer5rZe0H/O+kUiKOL9AJ/pL9+ryzNXtSN7ABfjfM=
 github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
 github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
-github.com/smallstep/certificates v0.25.0 h1:WWihtjQ7SprnRxDV44mBp8t5SMsNO5EWsQaEwy1rgFg=
-github.com/smallstep/certificates v0.25.0/go.mod h1:thJmekMKUplKYip+la99Lk4IwQej/oVH/zS9PVMagEE=
+github.com/smallstep/certificates v0.27.2 h1:MrSJvJviS9pCUtGYYguYyB1VQzZBmkL6ngLQZfVwRqU=
+github.com/smallstep/certificates v0.27.2/go.mod h1:v+u39A+fMBM3cFELPfAweaNce4RPm9AHUx9iwE0ene8=
 github.com/smallstep/go-attestation v0.4.4-0.20240109183208-413678f90935 h1:kjYvkvS/Wdy0PVRDUAA0gGJIVSEZYhiAJtfwYgOYoGA=
 github.com/smallstep/go-attestation v0.4.4-0.20240109183208-413678f90935/go.mod h1:vNAduivU014fubg6ewygkAvQC0IQVXqdc8vaGl/0er4=
-github.com/smallstep/nosql v0.6.0 h1:ur7ysI8s9st0cMXnTvB8tA3+x5Eifmkb6hl4uqNV5jc=
-github.com/smallstep/nosql v0.6.0/go.mod h1:jOXwLtockXORUPPZ2MCUcIkGR6w0cN1QGZniY9DITQA=
-github.com/smallstep/truststore v0.12.1 h1:guLUKkc1UlsXeS3t6BuVMa4leOOpdiv02PCRTiy1WdY=
-github.com/smallstep/truststore v0.12.1/go.mod h1:M4mebeNy28KusGX3lJxpLARIktLcyqBOrj3ZiZ46pqw=
+github.com/smallstep/nosql v0.7.0 h1:YiWC9ZAHcrLCrayfaF+QJUv16I2bZ7KdLC3RpJcnAnE=
+github.com/smallstep/nosql v0.7.0/go.mod h1:H5VnKMCbeq9QA6SRY5iqPylfxLfYcLwvUff3onQ8+HU=
+github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
+github.com/smallstep/pkcs7 v0.0.0-20240723090913-5e2c6a136dfa h1:FtxzVccOwaK+bK4bnWBPGua0FpCOhrVyeo6Fy9nxdlo=
+github.com/smallstep/pkcs7 v0.0.0-20240723090913-5e2c6a136dfa/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
+github.com/smallstep/scep v0.0.0-20240214080410-892e41795b99 h1:e85HuLX5/MW15yJ7yWb/PMNFW1Kx1N+DeQtpQnlMUbw=
+github.com/smallstep/scep v0.0.0-20240214080410-892e41795b99/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=
+github.com/smallstep/truststore v0.13.0 h1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi/py4=
+github.com/smallstep/truststore v0.13.0/go.mod h1:3tmMp2aLKZ/OA/jnFUB0cYPcho402UG2knuJoPh4j7A=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
 github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
@@ -446,43 +412,42 @@ github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
 github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
-github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
+github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
-github.com/spf13/viper v1.18.2 h1:LUXCnvUvSM6FXAsj6nnfc8Q2tp1dIgUfY9Kc8GsSOiQ=
-github.com/spf13/viper v1.18.2/go.mod h1:EKmWIqdnk5lOcmR72yw6hS+8OPYcwD0jteitLMVB+yk=
+github.com/spf13/viper v1.19.0 h1:RWq5SEjt8o25SROyN3z2OrDB9l7RPd3lwTWU8EcEdcI=
+github.com/spf13/viper v1.19.0/go.mod h1:GQUN9bilAbhU/jgc1bKs99f/suXKeUMct8Adx5+Ntkg=
 github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
 github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046 h1:8rUlviSVOEe7TMk7W0gIPrW8MqEzYfZHpsNWSf8s2vg=
-github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU=
+github.com/tailscale/tscert v0.0.0-20240608151842-d3f834017e53 h1:uxMgm0C+EjytfAqyfBG55ZONKQ7mvd7x4YYCWsf8QHQ=
+github.com/tailscale/tscert v0.0.0-20240608151842-d3f834017e53/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.17.0 h1:/Jocvlh98kcTfpN2+JzGQWQcqrPQwDrVEMApx/M5ZwM=
-github.com/tidwall/gjson v1.17.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.17.1 h1:wlYEnwqAHgzmhNUFfw7Xalt2JzQvsMx2Se4PcoFCT/U=
+github.com/tidwall/gjson v1.17.1/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
@@ -493,10 +458,10 @@ github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0=
 github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
-github.com/unrolled/secure v1.14.0 h1:u9vJTU/pR4Bny0ntLUMxdfLtmIRGvQf2sEFuA0TG9AE=
-github.com/unrolled/secure v1.14.0/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
-github.com/urfave/cli v1.22.14 h1:ebbhrRiGK2i4naQJr+1Xj92HXZCrK7MsyTS/ob3HnAk=
-github.com/urfave/cli v1.22.14/go.mod h1:X0eDS6pD6Exaclxm99NJ3FiCDRED7vIHpx2mDOHLvkA=
+github.com/unrolled/secure v1.15.0 h1:q7x+pdp8jAHnbzxu6UheP8fRlG/rwYTb8TPuQ3rn9Og=
+github.com/unrolled/secure v1.15.0/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
+github.com/urfave/cli v1.22.15 h1:nuqt+pdC/KqswQKhETJjo7pvn/k4xMUxgW6liI7XpnM=
+github.com/urfave/cli v1.22.15/go.mod h1:wSan1hmo5zeyLGBjRJbzRTNk8gwoYa2B9n4q9dmRIc0=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
@@ -504,26 +469,24 @@ github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zI
 github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.6.0 h1:boZcn2GTjpsynOsC0iJHnBWa4Bi0qzfJjthwauItG68=
-github.com/yuin/goldmark v1.6.0/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.7.4 h1:BDXOHExt+A7gwPCJgPIIq7ENvceR7we7rOS9TNoLZeg=
+github.com/yuin/goldmark v1.7.4/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
 github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
 github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
-github.com/zeebo/blake3 v0.2.3 h1:TFoLXsjeXqRNFxSbk35Dk4YtszE/MQQGK10BH4ptoTg=
-github.com/zeebo/blake3 v0.2.3/go.mod h1:mjJjZpnsyIVtVgTOSpJ9vmRE4wgDeyt2HU3qXvvKCaQ=
+github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
+github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
-github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
-go.etcd.io/bbolt v1.3.8 h1:xs88BrvEv273UsB79e0hcVrlUWmS0a8upikMFhSyAtA=
-go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
-go.mozilla.org/pkcs7 v0.0.0-20210730143726-725912489c62/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
-go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 h1:CCriYyAfq1Br1aIYettdHZTy8mBTIPo7We18TuO/bak=
-go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
+go.etcd.io/bbolt v1.3.11 h1:yGEzV1wPz2yVCLsD8ZAiGHhHVlczyC9d1rP43/VCRJ0=
+go.etcd.io/bbolt v1.3.11/go.mod h1:dksAq7YMXoljX0xu6VF5DMZGbhYYoLUalEiSySYAS4I=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 h1:4Pp6oUg3+e/6M4C0A/3kJ2VYa++dsWVTtGgLVj5xtHg=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0/go.mod h1:Mjt1i1INqiaoZOMGR1RIUJN+i3ChKoFRqzrRQhlkbs0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
 go.opentelemetry.io/contrib/propagators/autoprop v0.45.0 h1:FT/JCFzjzXgyp/aXkQeywnI/Tl8ZtKhvusVtZOokmFM=
 go.opentelemetry.io/contrib/propagators/autoprop v0.45.0/go.mod h1:L/2JIbqAmGzBvGJ3rXA+KXmWXUuUYUDZnhXeJttjJRg=
 go.opentelemetry.io/contrib/propagators/aws v1.20.0 h1:PByDRx6xPygwFP+L3FTlOifJoCB10T2LdRBZcDYMTJw=
@@ -534,101 +497,73 @@ go.opentelemetry.io/contrib/propagators/jaeger v1.20.0 h1:iVhNKkMIpzyZqxk8jkDU2n
 go.opentelemetry.io/contrib/propagators/jaeger v1.20.0/go.mod h1:cpSABr0cm/AH/HhbJjn+AudBVUMgZWdfN3Gb+ZqxSZc=
 go.opentelemetry.io/contrib/propagators/ot v1.20.0 h1:duH7mgL6VGQH7e7QEAVOFkCQXWpCb4PjTtrhdrYrJRQ=
 go.opentelemetry.io/contrib/propagators/ot v1.20.0/go.mod h1:gijQzxOq0JLj9lyZhTvqjDddGV/zaNagpPIn+2r8CEI=
-go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
-go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
+go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo=
+go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
-go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
-go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
+go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
+go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
 go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
 go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
-go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
-go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
+go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
 go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
-go.step.sm/cli-utils v0.8.0 h1:b/Tc1/m3YuQq+u3ghTFP7Dz5zUekZj6GUmd5pCvkEXQ=
-go.step.sm/cli-utils v0.8.0/go.mod h1:S77aISrC0pKuflqiDfxxJlUbiXcAanyJ4POOnzFSxD4=
-go.step.sm/crypto v0.36.0 h1:njrVQqjWVyCzHxqQUDprR7HXypZX8IxtOqe4IIHSjgU=
-go.step.sm/crypto v0.36.0/go.mod h1:XMRbgkhoigPLaPMjZeY1VFIYXVw03Wul0+5lENF6l7c=
-go.step.sm/linkedca v0.20.1 h1:bHDn1+UG1NgRrERkWbbCiAIvv4lD5NOFaswPDTyO5vU=
-go.step.sm/linkedca v0.20.1/go.mod h1:Vaq4+Umtjh7DLFI1KuIxeo598vfBzgSYZUjgVJ7Syxw=
-go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
-go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.step.sm/cli-utils v0.9.0 h1:55jYcsQbnArNqepZyAwcato6Zy2MoZDRkWW+jF+aPfQ=
+go.step.sm/cli-utils v0.9.0/go.mod h1:Y/CRoWl1FVR9j+7PnAewufAwKmBOTzR6l9+7EYGAnp8=
+go.step.sm/crypto v0.51.1 h1:ktUg/2hetEMiBAqgz502ktZDGoDoGrcHFg3XpkmkvvA=
+go.step.sm/crypto v0.51.1/go.mod h1:PdrhttNU/tG9/YsVd4fdlysBN+UV503p0o2irFZQlAw=
+go.step.sm/linkedca v0.22.1 h1:GvprpH9P4Sv9U+eZ3bxDgRSSpW14cFDYpe1kS6yWLkw=
+go.step.sm/linkedca v0.22.1/go.mod h1:dOKdF4HSn73YUEkfS5/FECngZmBtj2Il5DTKWXY4S6Y=
 go.uber.org/automaxprocs v1.5.3 h1:kWazyxZUrS3Gs4qUpbwo5kEIMGe/DAvi5Z4tl2NW4j8=
 go.uber.org/automaxprocs v1.5.3/go.mod h1:eRbA25aqJrxAbsLO0xy5jVwPt7FQnRgjW+efnwa1WM0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
 go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
-go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
-go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
-go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
-go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap/exp v0.2.0 h1:FtGenNNeCATRB3CmB/yEUnjEFeJWpB/pMcy7e2bKPYs=
+go.uber.org/zap/exp v0.2.0/go.mod h1:t0gqAIdh1MfKv9EwN/dLwfZnJxe9ITAZN78HEWPFWDQ=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
-golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
-golang.org/x/exp v0.0.0-20240119083558-1b970713d09a h1:Q8/wZp0KX97QFTc2ywcOE0YRjZPVIx+MXInMzdvQqcA=
-golang.org/x/exp v0.0.0-20240119083558-1b970713d09a/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
+golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20240806160748-b2d3a6a4b4d3 h1:oWb21rU9Q9XrRwXLB7jHc1rbp6EiiimZZv5MLxpu4T0=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20240806160748-b2d3a6a4b4d3/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
+golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 h1:kx6Ds3MlpiUHKj7syVnbp57++8WpuKPcR5yjLBjvLEA=
+golang.org/x/exp v0.0.0-20240823005443-9b4947da3948/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.0.0-20170726083632-f5079bd7f6f7/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
+golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
-golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
-golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
+golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
+golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
+golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20170728174421-0f826bdd13b5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -640,82 +575,62 @@ golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
-golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
+golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.16.0 h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=
-golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
+golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
+golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
+golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
-golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
-golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24=
+golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.153.0 h1:N1AwGhielyKFaUqH07/ZSIQR3uNPcV7NVw0vj+j4iR4=
-google.golang.org/api v0.153.0/go.mod h1:3qNJX5eOmhiWYc67jRA/3GsDw97UFb5ivv7Y2PrriAY=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac h1:ZL/Teoy/ZGnzyrqK/Optxxp2pmVh+fmJ97slxSRyzUg=
-google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac/go.mod h1:+Rvu7ElI+aLzyDQhpHMFMMltsD6m7nqpuWDd2CwJw3k=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe h1:0poefMBYvYbs7g5UkjS6HcxBPaTRAmznle9jnxYoAI8=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe h1:bQnxqljG/wqi4NTXu2+DJ3n7APcEA882QZ1JvhQAq9o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
-google.golang.org/grpc v1.61.0 h1:TOvOcuXn30kRao+gfcvsebNEa5iZIiLkisYEkf7R7o0=
-google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/api v0.189.0 h1:equMo30LypAkdkLMBqfeIqtyAnlyig1JSZArl4XPwdI=
+google.golang.org/api v0.189.0/go.mod h1:FLWGJKb0hb+pU2j+rJqwbnsF+ym+fQs73rbJ+KAUgy8=
+google.golang.org/genproto v0.0.0-20240722135656-d784300faade h1:lKFsS7wpngDgSCeFn7MoLy+wBDQZ1UQIJD4UNM1Qvkg=
+google.golang.org/genproto v0.0.0-20240722135656-d784300faade/go.mod h1:FfBgJBJg9GcpPvKIuHSZ/aE1g2ecGL74upMzGZjiGEY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7 h1:YcyjlL1PRr2Q17/I0dPk2JmYS5CDXfcdb2Z3YRioEbw=
+google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7/go.mod h1:OCdP9MfskevB/rbYvHTsXTtKC+3bHWajPdoKgjcYkfo=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7 h1:2035KHhUv+EpyB+hWgJnaWKJOdX1E95w2S8Rr4uWKTs=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
+google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
+google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
-gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
-gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=

caddy/php-server.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	mercureModule "github.com/dunglas/mercure/caddy"
+	"go.uber.org/zap/zapcore"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -21,7 +22,6 @@ import (
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp/rewrite"
 	"github.com/caddyserver/certmagic"
 	"github.com/dunglas/frankenphp"
-	"go.uber.org/zap"
 
 	"github.com/spf13/cobra"
 )
@@ -125,9 +125,11 @@ func cmdPHPServer(fs caddycmd.Flags) (int, error) {
 	extensions := []string{"php"}
 	tryFiles := []string{"{http.request.uri.path}", "{http.request.uri.path}/" + indexFile, indexFile}
 
+	rrs := true
 	phpHandler := FrankenPHPModule{
-		Root:      root,
-		SplitPath: extensions,
+		Root:               root,
+		SplitPath:          extensions,
+		ResolveRootSymlink: &rrs,
 	}
 
 	// route to redirect to canonical path if index PHP file
@@ -311,7 +313,7 @@ func cmdPHPServer(fs caddycmd.Flags) (int, error) {
 		cfg.Logging = &caddy.Logging{
 			Logs: map[string]*caddy.CustomLog{
 				"default": {
-					BaseLog: caddy.BaseLog{Level: zap.DebugLevel.CapitalString()},
+					BaseLog: caddy.BaseLog{Level: zapcore.DebugLevel.CapitalString()},
 				},
 			},
 		}

cgi.go

@@ -1,12 +1,15 @@
 package frankenphp
 
+// #include "frankenphp.h"
 import "C"
 import (
 	"crypto/tls"
 	"net"
 	"net/http"
 	"path/filepath"
+	"runtime"
 	"strings"
+	"unsafe"
 )
 
 type serverKey int
@@ -33,22 +36,44 @@ const (
 	sslProtocol
 )
 
-func allocServerVariable(cArr *[27]*C.char, env map[string]string, serverKey serverKey, envKey string, val string) {
-	if val, ok := env[envKey]; ok {
-		cArr[serverKey] = C.CString(val)
-		delete(env, envKey)
+var knownServerKeys = map[string]struct{}{
+	"CONTENT_LENGTH\x00":    {},
+	"DOCUMENT_ROOT\x00":     {},
+	"DOCUMENT_URI\x00":      {},
+	"GATEWAY_INTERFACE\x00": {},
+	"HTTP_HOST\x00":         {},
+	"HTTPS\x00":             {},
+	"PATH_INFO\x00":         {},
+	"PHP_SELF\x00":          {},
+	"REMOTE_ADDR\x00":       {},
+	"REMOTE_HOST\x00":       {},
+	"REMOTE_PORT\x00":       {},
+	"REQUEST_SCHEME\x00":    {},
+	"SCRIPT_FILENAME\x00":   {},
+	"SCRIPT_NAME\x00":       {},
+	"SERVER_NAME\x00":       {},
+	"SERVER_PORT\x00":       {},
+	"SERVER_PROTOCOL\x00":   {},
+	"SERVER_SOFTWARE\x00":   {},
+	"SSL_PROTOCOL\x00":      {},
+}
 
+func setKnownServerVariable(p *runtime.Pinner, cArr *[27]C.go_string, serverKey serverKey, val string) {
+	if val == "" {
 		return
 	}
 
-	cArr[serverKey] = C.CString(val)
+	valData := unsafe.StringData(val)
+	p.Pin(valData)
+	cArr[serverKey].len = C.size_t(len(val))
+	cArr[serverKey].data = (*C.char)(unsafe.Pointer(valData))
 }
 
 // computeKnownVariables returns a set of CGI environment variables for the request.
 //
 // TODO: handle this case https://github.com/caddyserver/caddy/issues/3718
 // Inspired by https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go
-func computeKnownVariables(request *http.Request) (cArr [27]*C.char) {
+func computeKnownVariables(request *http.Request, p *runtime.Pinner) (cArr [27]C.go_string) {
 	fc, fcOK := FromContext(request.Context())
 	if !fcOK {
 		panic("not a FrankenPHP request")
@@ -67,32 +92,30 @@ func computeKnownVariables(request *http.Request) (cArr [27]*C.char) {
 	ip = strings.Replace(ip, "[", "", 1)
 	ip = strings.Replace(ip, "]", "", 1)
 
-	ra, raOK := fc.env["REMOTE_ADDR"]
+	ra, raOK := fc.env["REMOTE_ADDR\x00"]
 	if raOK {
-		cArr[remoteAddr] = C.CString(ra)
-		delete(fc.env, "REMOTE_ADDR")
+		setKnownServerVariable(p, &cArr, remoteAddr, ra)
 	} else {
-		cArr[remoteAddr] = C.CString(ip)
+		setKnownServerVariable(p, &cArr, remoteAddr, ip)
 	}
 
-	if rh, ok := fc.env["REMOTE_HOST"]; ok {
-		cArr[remoteHost] = C.CString(rh) // For speed, remote host lookups disabled
-		delete(fc.env, "REMOTE_HOST")
+	if rh, ok := fc.env["REMOTE_HOST\x00"]; ok {
+		setKnownServerVariable(p, &cArr, remoteHost, rh) // For speed, remote host lookups disabled
 	} else {
 		if raOK {
-			cArr[remoteHost] = C.CString(ip)
+			setKnownServerVariable(p, &cArr, remoteHost, ip)
 		} else {
 			cArr[remoteHost] = cArr[remoteAddr]
 		}
 	}
 
-	allocServerVariable(&cArr, fc.env, remotePort, "REMOTE_PORT", port)
-	allocServerVariable(&cArr, fc.env, documentRoot, "DOCUMENT_ROOT", fc.documentRoot)
-	allocServerVariable(&cArr, fc.env, pathInfo, "PATH_INFO", fc.pathInfo)
-	allocServerVariable(&cArr, fc.env, phpSelf, "PHP_SELF", request.URL.Path)
-	allocServerVariable(&cArr, fc.env, documentUri, "DOCUMENT_URI", fc.docURI)
-	allocServerVariable(&cArr, fc.env, scriptFilename, "SCRIPT_FILENAME", fc.scriptFilename)
-	allocServerVariable(&cArr, fc.env, scriptName, "SCRIPT_NAME", fc.scriptName)
+	setKnownServerVariable(p, &cArr, remotePort, port)
+	setKnownServerVariable(p, &cArr, documentRoot, fc.documentRoot)
+	setKnownServerVariable(p, &cArr, pathInfo, fc.pathInfo)
+	setKnownServerVariable(p, &cArr, phpSelf, request.URL.Path)
+	setKnownServerVariable(p, &cArr, documentUri, fc.docURI)
+	setKnownServerVariable(p, &cArr, scriptFilename, fc.scriptFilename)
+	setKnownServerVariable(p, &cArr, scriptName, fc.scriptName)
 
 	var rs string
 	if request.TLS == nil {
@@ -100,26 +123,24 @@ func computeKnownVariables(request *http.Request) (cArr [27]*C.char) {
 	} else {
 		rs = "https"
 
-		if h, ok := fc.env["HTTPS"]; ok {
-			cArr[https] = C.CString(h)
-			delete(fc.env, "HTTPS")
+		if h, ok := fc.env["HTTPS\x00"]; ok {
+			setKnownServerVariable(p, &cArr, https, h)
 		} else {
-			cArr[https] = C.CString("on")
+			setKnownServerVariable(p, &cArr, https, "on")
 		}
 
 		// and pass the protocol details in a manner compatible with apache's mod_ssl
 		// (which is why these have a SSL_ prefix and not TLS_).
-		if p, ok := fc.env["SSL_PROTOCOL"]; ok {
-			cArr[sslProtocol] = C.CString(p)
-			delete(fc.env, "SSL_PROTOCOL")
+		if pr, ok := fc.env["SSL_PROTOCOL\x00"]; ok {
+			setKnownServerVariable(p, &cArr, sslProtocol, pr)
 		} else {
 			if v, ok := tlsProtocolStrings[request.TLS.Version]; ok {
-				cArr[sslProtocol] = C.CString(v)
+				setKnownServerVariable(p, &cArr, sslProtocol, v)
 			}
 		}
 	}
-	allocServerVariable(&cArr, fc.env, requestScheme, "REQUEST_SCHEME", rs)
 
+	setKnownServerVariable(p, &cArr, requestScheme, rs)
 	reqHost, reqPort, _ := net.SplitHostPort(request.Host)
 
 	if reqHost == "" {
@@ -140,9 +161,9 @@ func computeKnownVariables(request *http.Request) (cArr [27]*C.char) {
 		}
 	}
 
-	allocServerVariable(&cArr, fc.env, serverName, "SERVER_NAME", reqHost)
+	setKnownServerVariable(p, &cArr, serverName, reqHost)
 	if reqPort != "" {
-		allocServerVariable(&cArr, fc.env, serverPort, "SERVER_PORT", reqPort)
+		setKnownServerVariable(p, &cArr, serverPort, reqPort)
 	}
 
 	// Variables defined in CGI 1.1 spec
@@ -150,12 +171,11 @@ func computeKnownVariables(request *http.Request) (cArr [27]*C.char) {
 	// the parent environment from interfering.
 
 	// These values can not be override
-	cArr[contentLength] = C.CString(request.Header.Get("Content-Length"))
-
-	allocServerVariable(&cArr, fc.env, gatewayInterface, "GATEWAY_INTERFACE", "CGI/1.1")
-	allocServerVariable(&cArr, fc.env, serverProtocol, "SERVER_PROTOCOL", request.Proto)
-	allocServerVariable(&cArr, fc.env, serverSoftware, "SERVER_SOFTWARE", "FrankenPHP")
-	allocServerVariable(&cArr, fc.env, httpHost, "HTTP_HOST", request.Host) // added here, since not always part of headers
+	setKnownServerVariable(p, &cArr, contentLength, request.Header.Get("Content-Length"))
+	setKnownServerVariable(p, &cArr, gatewayInterface, "CGI/1.1")
+	setKnownServerVariable(p, &cArr, serverProtocol, request.Proto)
+	setKnownServerVariable(p, &cArr, serverSoftware, "FrankenPHP")
+	setKnownServerVariable(p, &cArr, httpHost, request.Host) // added here, since not always part of headers
 
 	return
 }

dev-alpine.Dockerfile

@@ -1,8 +1,10 @@
 # syntax=docker/dockerfile:1
-FROM golang:1.21-alpine
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+FROM golang:1.22-alpine
 
 ENV CFLAGS="-ggdb3"
-ENV PHPIZE_DEPS \
+ENV PHPIZE_DEPS="\
 	autoconf \
 	dpkg-dev \
 	file \
@@ -11,7 +13,7 @@ ENV PHPIZE_DEPS \
 	libc-dev \
 	make \
 	pkgconfig \
-	re2c
+	re2c"
 
 RUN apk add --no-cache \
 	$PHPIZE_DEPS \

dev.Dockerfile

@@ -1,8 +1,10 @@
 # syntax=docker/dockerfile:1
-FROM golang:1.21
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+FROM golang:1.22
 
 ENV CFLAGS="-ggdb3"
-ENV PHPIZE_DEPS \
+ENV PHPIZE_DEPS="\
 	autoconf \
 	dpkg-dev \
 	file \
@@ -11,7 +13,7 @@ ENV PHPIZE_DEPS \
 	libc-dev \
 	make \
 	pkg-config \
-	re2c
+	re2c"
 
 # hadolint ignore=DL3009
 RUN apt-get update && \
@@ -65,7 +67,7 @@ WORKDIR /go/src/app
 COPY . .
 
 WORKDIR /go/src/app/caddy/frankenphp
-RUN go build
+RUN go build -buildvcs=false
 
 WORKDIR /go/src/app
 CMD [ "zsh" ]

docker-bake.hcl

@@ -11,13 +11,13 @@ variable "PHP_VERSION" {
 }
 
 variable "GO_VERSION" {
-    default = "1.21"
+    default = "1.22"
 }
 
 variable "SHA" {}
 
 variable "LATEST" {
-    default = false
+    default = true
 }
 
 variable "CACHE" {
@@ -31,14 +31,14 @@ variable DEFAULT_PHP_VERSION {
 function "tag" {
     params = [version, os, php-version, tgt]
     result = [
-        version != "" ? format("%s:%s%s-php%s-%s", IMAGE_NAME, version, tgt == "builder" ? "-builder" : "", php-version, os) : "",
-        php-version == DEFAULT_PHP_VERSION && os == "bookworm"  && version != "" ? format("%s:%s%s", IMAGE_NAME, version, tgt == "builder" ? "-builder" : "") : "",
-        php-version == DEFAULT_PHP_VERSION && version != "" ? format("%s:%s%s-%s", IMAGE_NAME, version, tgt == "builder" ? "-builder" : "", os) : "",
-        php-version == DEFAULT_PHP_VERSION && version == "latest" ? format("%s:%s%s", IMAGE_NAME, os, tgt == "builder" ? "-builder" : "") : "",
-        os == "bookworm" && version != "" ? format("%s:%s%s-php%s", IMAGE_NAME, version, tgt == "builder" ? "-builder" : "", php-version) : "",
+        version == "" ? "" : "${IMAGE_NAME}:${trimprefix("${version}${tgt == "builder" ? "-builder" : ""}-php${php-version}-${os}", "latest-")}",
+        php-version == DEFAULT_PHP_VERSION && os == "bookworm" && version != "" ? "${IMAGE_NAME}:${trimprefix("${version}${tgt == "builder" ? "-builder" : ""}", "latest-")}" : "",
+        php-version == DEFAULT_PHP_VERSION && version != "" ? "${IMAGE_NAME}:${trimprefix("${version}${tgt == "builder" ? "-builder" : ""}-${os}", "latest-")}" : "",
+        os == "bookworm" && version != "" ? "${IMAGE_NAME}:${trimprefix("${version}${tgt == "builder" ? "-builder" : ""}-php${php-version}", "latest-")}" : "",
     ]
 }
 
+# cleanTag ensures that the tag is a valid Docker tag
 # cleanTag ensures that the tag is a valid Docker tag
 # see https://github.com/distribution/distribution/blob/v2.8.2/reference/regexp.go#L37
 function "clean_tag" {
@@ -60,7 +60,7 @@ function "_semver" {
 
 function "__semver" {
     params = [v]
-    result = v == {} ? [clean_tag(VERSION)] : v.prerelease == null ? ["latest", v.major, "${v.major}.${v.minor}", "${v.major}.${v.minor}.${v.patch}"] : ["${v.major}.${v.minor}.${v.patch}-${v.prerelease}"]
+    result = v == {} ? [clean_tag(VERSION)] : v.prerelease == null ? [v.major, "${v.major}.${v.minor}", "${v.major}.${v.minor}.${v.patch}"] : ["${v.major}.${v.minor}.${v.patch}-${v.prerelease}"]
 }
 
 function "php_version" {
@@ -91,7 +91,8 @@ target "default" {
     platforms = os == "alpine" ? [
         "linux/amd64",
         "linux/386",
-        "linux/arm/v6",
+        # FIXME: armv6 doesn't build in GitHub actions because we use a custom Go build
+        #"linux/arm/v6",
         "linux/arm/v7",
         "linux/arm64",
     ] : [
@@ -103,8 +104,8 @@ target "default" {
     tags = distinct(flatten(
         [for pv in php_version(php-version) : flatten([
             LATEST ? tag("latest", os, pv, tgt) : [],
-            tag(SHA == "" ? "" : "sha-${substr(SHA, 0, 7)}", os, pv, tgt),
-            [for v in semver(VERSION) : tag(v, os, pv, tgt)]
+            tag(SHA == "" || VERSION != "dev" ? "" : "sha-${substr(SHA, 0, 7)}", os, pv, tgt),
+            VERSION == "dev" ? [] : [for v in semver(VERSION) : tag(v, os, pv, tgt)]
         ])
     ]))
     labels = {
@@ -129,8 +130,8 @@ target "static-builder" {
     ]
     tags = distinct(flatten([
         LATEST ? "${IMAGE_NAME}:static-builder" : "",
-        SHA == "" ? "" : "${IMAGE_NAME}:static-builder-sha-${substr(SHA, 0, 7)}",
-        [for v in semver(VERSION) : v == "latest" ? "${IMAGE_NAME}:static-builder": "${IMAGE_NAME}:static-builder-${v}"]
+        SHA == "" || VERSION != "dev" ? "" : "${IMAGE_NAME}:static-builder-sha-${substr(SHA, 0, 7)}",
+        VERSION == "dev" ? [] : [for v in semver(VERSION) : "${IMAGE_NAME}:static-builder-${v}"]
     ]))
     labels = {
         "org.opencontainers.image.created" = "${timestamp()}"

docs/cn/CONTRIBUTING.md

@@ -0,0 +1,215 @@
+# 贡献
+
+## 编译 PHP
+
+### 使用 Docker (Linux)
+
+构建开发环境 Docker 镜像：
+
+```console
+docker build -t frankenphp-dev -f dev.Dockerfile .
+docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -p 8080:8080 -p 443:443 -p 443:443/udp -v $PWD:/go/src/app -it frankenphp-dev
+```
+
+该镜像包含常用的开发工具（Go、GDB、Valgrind、Neovim等）。
+
+如果 docker 版本低于 23.0，则会因为 dockerignore [pattern issue](https://github.com/moby/moby/pull/42676) 而导致构建失败。将目录添加到 `.dockerignore`。
+
+```patch
+ !testdata/*.php
+ !testdata/*.txt
++!caddy
++!internal
+```
+
+### 不使用 Docker (Linux 和 macOS)
+
+[按照说明从源代码编译](https://frankenphp.dev/docs/compile/) 并传递 `--debug` 配置标志。
+
+## 运行测试套件
+
+```console
+go test -race -v ./...
+```
+
+## Caddy 模块
+
+使用 FrankenPHP Caddy 模块构建 Caddy：
+
+```console
+cd caddy/frankenphp/
+go build
+cd ../../
+```
+
+使用 FrankenPHP Caddy 模块运行 Caddy：
+
+```console
+cd testdata/
+../caddy/frankenphp/frankenphp run
+```
+
+服务器正在监听 `127.0.0.1:8080`：
+
+```console
+curl -vk https://localhost/phpinfo.php
+```
+
+## 最小测试服务器
+
+构建最小测试服务器：
+
+```console
+cd internal/testserver/
+go build
+cd ../../
+```
+
+运行测试服务器：
+
+```console
+cd testdata/
+../internal/testserver/testserver
+```
+
+服务器正在监听 `127.0.0.1:8080`：
+
+```console
+curl -v http://127.0.0.1:8080/phpinfo.php
+```
+
+## 本地构建 Docker 镜像
+
+打印 bake 计划:
+
+```console
+docker buildx bake -f docker-bake.hcl --print
+```
+
+本地构建 amd64 的 FrankenPHP 镜像：
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --load --set "*.platform=linux/amd64"
+```
+
+本地构建 arm64 的 FrankenPHP 镜像：
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --load --set "*.platform=linux/arm64"
+```
+
+从头开始为 arm64 和 amd64 构建 FrankenPHP 镜像并推送到 Docker Hub：
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --no-cache --push
+```
+
+## 使用静态构建调试分段错误
+
+1. 从 GitHub 下载 FrankenPHP 二进制文件的调试版本或创建包含调试符号的自定义静态构建：
+
+    ```console
+    docker buildx bake \
+        --load \
+        --set static-builder.args.DEBUG_SYMBOLS=1 \
+        --set "static-builder.platform=linux/amd64" \
+        static-builder
+    docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/dist/frankenphp-linux-$(uname -m) frankenphp
+    ```
+
+2. 将当前版本的 `frankenphp` 替换为 debug FrankenPHP 可执行文件
+3. 照常启动 FrankenPHP（或者，你可以直接使用 GDB 启动 FrankenPHP： `gdb --args ./frankenphp run`）
+4. 使用 GDB 附加到进程：
+
+    ```console
+    gdb -p `pidof frankenphp`
+    ```
+
+5. 如有必要，请在 GDB shell 中输入 `continue`
+6. 使 FrankenPHP 崩溃
+7. 在 GDB shell 中输入 `bt`
+8. 复制输出
+
+## 在 GitHub Actions 中调试分段错误
+
+1. 打开 `.github/workflows/tests.yml`
+2. 启用 PHP 调试符号
+
+    ```patch
+        - uses: shivammathur/setup-php@v2
+          # ...
+          env:
+            phpts: ts
+    +       debug: true
+    ```
+
+3. 启用 `tmate` 以连接到容器
+
+    ```patch
+        -
+          name: Set CGO flags
+          run: echo "CGO_CFLAGS=$(php-config --includes)" >> "$GITHUB_ENV"
+    +   -
+    +     run: |
+    +       sudo apt install gdb
+    +       mkdir -p /home/runner/.config/gdb/
+    +       printf "set auto-load safe-path /\nhandle SIG34 nostop noprint pass" > /home/runner/.config/gdb/gdbinit
+    +   -
+    +     uses: mxschmitt/action-tmate@v3
+    ```
+
+4. 连接到容器
+5. 打开 `frankenphp.go`
+6. 启用 `cgosymbolizer`
+
+    ```patch
+    -	//_ "github.com/ianlancetaylor/cgosymbolizer"
+    +	_ "github.com/ianlancetaylor/cgosymbolizer"
+    ```
+
+7. 下载模块： `go get`
+8. 在容器中，可以使用 GDB 和以下：
+
+    ```console
+    go test -c -ldflags=-w
+    gdb --args ./frankenphp.test -test.run ^MyTest$
+    ```
+
+9. 当错误修复后，恢复所有这些更改
+
+## 其他开发资源
+
+* [PHP 嵌入 uWSGI](https://github.com/unbit/uwsgi/blob/master/plugins/php/php_plugin.c)
+* [PHP 嵌入 NGINX Unit](https://github.com/nginx/unit/blob/master/src/nxt_php_sapi.c)
+* [PHP 嵌入 Go (go-php)](https://github.com/deuill/go-php)
+* [PHP 嵌入 Go (GoEmPHP)](https://github.com/mikespook/goemphp)
+* [PHP 嵌入 C++](https://gist.github.com/paresy/3cbd4c6a469511ac7479aa0e7c42fea7)
+* [扩展和嵌入 PHP 作者：Sara Golemon](https://books.google.fr/books?id=zMbGvK17_tYC&pg=PA254&lpg=PA254#v=onepage&q&f=false)
+* [TSRMLS_CC到底是什么？](http://blog.golemon.com/2006/06/what-heck-is-tsrmlscc-anyway.html)
+* [Mac 上的 PHP 嵌入](https://gist.github.com/jonnywang/61427ffc0e8dde74fff40f479d147db4)
+* [SDL 绑定](https://pkg.go.dev/github.com/veandco/go-sdl2@v0.4.21/sdl#Main)
+
+## Docker 相关资源
+
+* [Bake 文件定义](https://docs.docker.com/build/customize/bake/file-definition/)
+* [docker buildx 构建](https://docs.docker.com/engine/reference/commandline/buildx_build/)
+
+## 有用的命令
+
+```console
+apk add strace util-linux gdb
+strace -e 'trace=!futex,epoll_ctl,epoll_pwait,tgkill,rt_sigreturn' -p 1
+```
+
+## 翻译文档
+
+要将文档和网站翻译成新语言，请按照下列步骤操作：
+
+1. 在此存储库的 `docs/` 目录中创建一个以语言的 2 个字符的 ISO 代码命名的新目录
+2. 将 `docs/` 目录根目录中的所有 `.md` 文件复制到新目录中（始终使用英文版本作为翻译源，因为它始终是最新的）
+3. 将 `README.md` 和 `CONTRIBUTING.md` 文件从根目录复制到新目录
+4. 翻译文件的内容，但不要更改文件名，也不要翻译以 `> [!` 开头的字符串（这是 GitHub 的特殊标记）
+5. 创建翻译的拉取请求
+6. 在 [站点存储库](https://github.com/dunglas/frankenphp-website/tree/main) 中，复制并翻译 `content/`、`data/` 和 `i18n/` 目录中的翻译文件
+7. 转换创建的 YAML 文件中的值
+8. 在站点存储库上打开拉取请求

docs/cn/README.md

@@ -0,0 +1,77 @@
+# FrankenPHP: 适用于 PHP 的现代应用服务器
+
+<h1 align="center"><a href="https://frankenphp.dev"><img src="frankenphp.png" alt="FrankenPHP" width="600"></a></h1>
+
+FrankenPHP 是建立在 [Caddy](https://caddyserver.com/) Web 服务器之上的现代 PHP 应用程序服务器。
+
+FrankenPHP 凭借其令人惊叹的功能为您的 PHP 应用程序提供了超能力：[早期提示](early-hints.md)、[worker 模式](worker.md)、[实时功能](mercure.md)、自动 HTTPS、HTTP/2 和 HTTP/3 支持......
+
+FrankenPHP 可与任何 PHP 应用程序一起使用，并且由于提供了与 worker 模式的集成，使您的 Symfony 和 Laravel 项目比以往任何时候都更快。
+
+FrankenPHP 也可以用作独立的 Go 库，将 PHP 嵌入到任何使用 net/http 的应用程序中。
+
+[**了解更多** *frankenphp.dev*](https://frankenphp.dev/cn) 以及在以下地址中：
+
+<a href="https://dunglas.dev/2022/10/frankenphp-the-modern-php-app-server-written-in-go/"><img src="https://dunglas.dev/wp-content/uploads/2022/10/frankenphp.png" alt="Slides" width="600"></a>
+
+## 开始
+
+### Docker
+
+```console
+docker run -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+访问 `https://localhost`, 并享受吧!
+
+> [!TIP]
+>
+> 不要尝试使用 `https://127.0.0.1`。使用 `https://localhost` 并接受自签名证书。
+> 使用 [`SERVER_NAME` 环境变量](config.md#环境变量) 更改要使用的域。
+
+### 独立二进制
+
+如果您不想使用 Docker，我们为 Linux 和 macOS 提供独立的 FrankenPHP 二进制文件
+，其中包含 [PHP 8.3](https://www.php.net/releases/8.3/en.php) 和最流行的 PHP 扩展：[下载 FrankenPHP](https://github.com/dunglas/frankenphp/releases)。
+
+若要启动当前目录的内容，请运行：
+
+```console
+./frankenphp php-server
+```
+
+您还可以使用以下命令运行命令行脚本：
+
+```console
+./frankenphp php-cli /path/to/your/script.php
+```
+
+## 文档
+
+* [worker 模式](worker.md)
+* [早期提示支持(103 HTTP status code)](early-hints.md)
+* [实时功能](mercure.md)
+* [配置](config.md)
+* [Docker 镜像](docker.md)
+* [在生产环境中部署](production.md)
+* [创建独立、可自行执行的 PHP 应用程序](embed.md)
+* [创建静态二进制文件](static.md)
+* [从源代码编译](compile.md)
+* [Laravel 集成](laravel.md)
+* [已知问题](known-issues.md)
+* [演示应用程序 (Symfony) 和性能测试](https://github.com/dunglas/frankenphp-demo)
+* [Go 库文档](https://pkg.go.dev/github.com/dunglas/frankenphp)
+* [贡献和调试](https://frankenphp.dev/docs/contributing/)
+
+## 示例和框架
+
+* [Symfony](https://github.com/dunglas/symfony-docker)
+* [API Platform](https://api-platform.com/docs/distribution/)
+* [Laravel](laravel.md)
+* [Sulu](https://sulu.io/blog/running-sulu-with-frankenphp)
+* [WordPress](https://github.com/StephenMiracle/frankenwp)
+* [Drupal](https://github.com/dunglas/frankenphp-drupal)
+* [Joomla](https://github.com/alexandreelise/frankenphp-joomla)
+* [TYPO3](https://github.com/ochorocho/franken-typo3)

docs/cn/compile.md

@@ -0,0 +1,98 @@
+# 从源代码编译
+
+本文档解释了如何创建一个 FrankenPHP 构建，它将 PHP 加载为一个动态库。
+这是推荐的方法。
+
+或者，你也可以 [编译静态版本](static.md)。
+
+## 安装 PHP
+
+FrankenPHP 支持 PHP 8.2 及更高版本。
+
+首先，[获取 PHP 源代码](https://www.php.net/downloads.php) 并提取它们：
+
+```console
+tar xf php-*
+cd php-*/
+```
+
+然后，为您的平台配置 PHP.
+
+这些参数是必需的，但你也可以添加其他编译参数（例如额外的扩展）。
+
+### Linux
+
+```console
+./configure \
+    --enable-embed \
+    --enable-zts \
+    --disable-zend-signals \
+    --enable-zend-max-execution-timers
+```
+
+### Mac
+
+使用 [Homebrew](https://brew.sh/) 包管理器安装 `libiconv`、`bison`、`re2c` 和 `pkg-config`：
+
+```console
+brew install libiconv bison re2c pkg-config
+echo 'export PATH="/opt/homebrew/opt/bison/bin:$PATH"' >> ~/.zshrc
+```
+
+然后运行 `./configure` 脚本：
+
+```console
+./configure \
+    --enable-embed=static \
+    --enable-zts \
+    --disable-zend-signals \
+    --disable-opcache-jit \
+    --enable-static \
+    --enable-shared=no \
+    --with-iconv=/opt/homebrew/opt/libiconv/
+```
+
+## 编译并安装 PHP
+
+最后，编译并安装 PHP：
+
+```console
+make -j"$(getconf _NPROCESSORS_ONLN)"
+sudo make install
+```
+
+## 编译 Go 应用
+
+您现在可以使用 Go 库并编译我们的 Caddy 构建：
+
+```console
+curl -L https://github.com/dunglas/frankenphp/archive/refs/heads/main.tar.gz | tar xz
+cd frankenphp-main/caddy/frankenphp
+CGO_CFLAGS=$(php-config --includes) CGO_LDFLAGS="$(php-config --ldflags) $(php-config --libs)" go build
+```
+
+### 使用 xcaddy
+
+你可以使用 [xcaddy](https://github.com/caddyserver/xcaddy) 来编译 [自定义 Caddy 模块](https://caddyserver.com/docs/modules/) 的 FrankenPHP：
+
+```console
+CGO_ENABLED=1 \
+XCADDY_GO_BUILD_FLAGS="-ldflags '-w -s'" \
+xcaddy build \
+    --output frankenphp \
+    --with github.com/dunglas/frankenphp/caddy \
+    --with github.com/dunglas/caddy-cbrotli \
+    --with github.com/dunglas/mercure/caddy \
+    --with github.com/dunglas/vulcain/caddy
+    # Add extra Caddy modules here
+```
+
+> [!TIP]
+>
+> 如果你的系统基于 musl libc（Alpine Linux 上默认使用）并搭配 Symfony 使用，
+> 您可能需要增加默认堆栈大小。
+> 否则，您可能会收到如下错误 `PHP Fatal error: Maximum call stack size of 83360 bytes reached during compilation. Try splitting expression`
+>
+> 请将 `XCADDY_GO_BUILD_FLAGS` 环境变量更改为如下类似的值
+> `XCADDY_GO_BUILD_FLAGS=$'-ldflags "-w -s -extldflags \'-Wl,-z,stack-size=0x80000\'"'`
+> （根据您的应用需求更改堆栈大小）。

docs/cn/config.md

@@ -0,0 +1,152 @@
+# 配置
+
+FrankenPHP，Caddy 以及 Mercure 和 Vulcain 模块可以使用 [Caddy 支持的格式](https://caddyserver.com/docs/getting-started#your-first-config) 进行配置。
+
+在 Docker 镜像中，`Caddyfile` 位于 `/etc/caddy/Caddyfile`。
+
+您也可以像往常一样使用 `php.ini` 配置 PHP。
+
+在 Docker 镜像中，默认不存在 `php.ini`，您可以手动创建它或从官方模板中复制。
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# 开发:
+RUN cp $PHP_INI_DIR/php.ini-development $PHP_INI_DIR/php.ini
+
+# 生产:
+RUN cp $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
+```
+
+## Caddyfile 配置
+
+要注册 FrankenPHP 执行器，必须设置 `frankenphp` [全局选项](https://caddyserver.com/docs/caddyfile/concepts#global-options)，然后可以在站点块中使用 `php_server` 或 `php` [HTTP 指令](https://caddyserver.com/docs/caddyfile/concepts#directives) 来为您的 PHP 应用程序提供服务。
+
+最小示例：
+
+```caddyfile
+{
+	# 启用 FrankenPHP
+	frankenphp
+}
+
+localhost {
+	# 启用压缩（可选）
+	encode zstd br gzip
+	# 执行当前目录中的 PHP 文件并提供资产
+	php_server
+}
+```
+
+或者，可以在全局选项下指定要创建的线程数和要从服务器启动的 [worker 脚本](worker.md)。
+
+```caddyfile
+{
+	frankenphp {
+		num_threads <num_threads> # 设置要启动的 PHP 线程数。默认值：可用 CPU 数量的 2 倍。
+		worker {
+			file <path> # 设置 worker 脚本的路径。
+			num <num> # 设置要启动的 PHP 线程数，默认为可用 CPU 数的 2 倍。
+			env <key> <value> # 将额外的环境变量设置为给定值。可以为多个环境变量多次指定。
+		}
+	}
+}
+
+# ...
+```
+
+或者，您可以使用 `worker` 选项的一行缩写形式：
+
+```caddyfile
+{
+	frankenphp {
+		worker <file> <num>
+	}
+}
+
+# ...
+```
+
+如果在同一服务器上运行多个应用，还可以定义多个 worker：
+
+```caddyfile
+{
+	frankenphp {
+		worker /path/to/app/public/index.php <num>
+		worker /path/to/other/public/index.php <num>
+	}
+}
+
+app.example.com {
+	root * /path/to/app/public
+	php_server
+}
+
+other.example.com {
+	root * /path/to/other/public
+	php_server
+}
+# ...
+```
+
+通常你只需要 `php_server` 指令，
+但如果要完全控制，则可以使用较低级别的 `php` 指令：
+
+使用 `php_server` 指令等效于以下配置：
+
+```caddyfile
+route {
+	# 为目录请求添加尾部斜杠
+	@canonicalPath {
+		file {path}/index.php
+		not path */
+	}
+	redir @canonicalPath {path}/ 308
+	# 如果请求的文件不存在，则尝试 index 文件
+	@indexFiles file {
+		try_files {path} {path}/index.php index.php
+		split_path .php
+	}
+	rewrite @indexFiles {http.matchers.file.relative}
+	# FrankenPHP!
+	@phpFiles path *.php
+	php @phpFiles
+	file_server
+}
+```
+
+`php_server` 和 `php` 指令具有以下选项：
+
+```caddyfile
+php_server [<matcher>] {
+	root <directory> # 设置站点的根目录。默认值：`root` 指令。
+	split_path <delim...> # 设置用于将 URI 拆分为两部分的子字符串。第一个匹配的子字符串将用于从路径中拆分“路径信息”。第一个部分以匹配的子字符串为后缀，并将假定为实际资源(CGI 脚本)名称。第二部分将设置为PATH_INFO，供脚本使用。默认值：`.php`
+	resolve_root_symlink false # 禁用将 `root` 目录在符号链接时将其解析为实际值（默认启用）。
+	env <key> <value> # 设置额外的环境变量，可以设置多个环境变量。
+}
+```
+
+## 环境变量
+
+以下环境变量可用于在 `Caddyfile` 中注入 Caddy 指令，而无需对其进行修改：
+
+* `SERVER_NAME`: 更改 [要监听的地址](https://caddyserver.com/docs/caddyfile/concepts#addresses)，提供的主机名也将用于生成的 TLS 证书
+* `CADDY_GLOBAL_OPTIONS`: 注入 [全局选项](https://caddyserver.com/docs/caddyfile/options)
+* `FRANKENPHP_CONFIG`: 在 `frankenphp` 指令下注入配置
+
+## PHP 配置
+
+要加载 [其他 PHP INI 配置文件](https://www.php.net/manual/en/configuration.file.php#configuration.file.scan)，
+可以使用 `PHP_INI_SCAN_DIR` 环境变量。
+设置后，PHP 将加载给定目录中存在 `.ini` 扩展名的所有文件。
+
+## 启用调试模式
+
+使用 Docker 镜像时，将 `CADDY_GLOBAL_OPTIONS` 环境变量设置为 `debug` 以启用调试模式：
+
+```console
+docker run -v $PWD:/app/public \
+    -e CADDY_GLOBAL_OPTIONS=debug \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```

docs/cn/docker.md

@@ -0,0 +1,165 @@
+# 构建自定义 Docker 镜像
+
+[FrankenPHP Docker 镜像](https://hub.docker.com/r/dunglas/frankenphp) 基于 [官方 PHP 镜像](https://hub.docker.com/_/php/)。
+Alpine Linux 和 Debian 衍生版适用于常见的处理器架构，且支持 PHP 8.2 和 PHP 8.3。[查看 Tags](https://hub.docker.com/r/dunglas/frankenphp/tags)。
+
+## 如何使用镜像
+
+在项目中创建 `Dockerfile`：
+
+```dockerfile
+FROM dunglas/frankenphp
+
+COPY . /app/public
+```
+
+然后运行以下命令以构建并运行 Docker 镜像：
+
+```console
+docker build -t my-php-app .
+docker run -it --rm --name my-running-app my-php-app
+```
+
+## 如何安装更多 PHP 扩展
+
+[`docker-php-extension-installer`](https://github.com/mlocati/docker-php-extension-installer) 脚本在基础镜像中提供。
+添加额外的 PHP 扩展很简单：
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# 在此处添加其他扩展：
+RUN install-php-extensions \
+  pdo_mysql \
+  gd \
+  intl \
+  zip \
+  opcache
+```
+
+## 如何安装更多 Caddy 模块
+
+FrankenPHP 建立在 Caddy 之上，所有 [Caddy 模块](https://caddyserver.com/docs/modules/) 都可以与 FrankenPHP 一起使用。
+
+安装自定义 Caddy 模块的最简单方法是使用 [xcaddy](https://github.com/caddyserver/xcaddy)：
+
+```dockerfile
+FROM dunglas/frankenphp:latest-builder AS builder
+
+# 在构建器镜像中复制 xcaddy
+COPY --from=caddy:builder /usr/bin/xcaddy /usr/bin/xcaddy
+
+# 必须启用 CGO 才能构建 FrankenPHP
+ENV CGO_ENABLED=1 XCADDY_SETCAP=1 XCADDY_GO_BUILD_FLAGS="-ldflags '-w -s'"
+RUN xcaddy build \
+  --output /usr/local/bin/frankenphp \
+  --with github.com/dunglas/frankenphp=./ \
+  --with github.com/dunglas/frankenphp/caddy=./caddy/ \
+  --with github.com/dunglas/caddy-cbrotli \
+  # Mercure 和 Vulcain 包含在官方版本中，如果不需要你可以删除它们
+  --with github.com/dunglas/mercure/caddy \
+  --with github.com/dunglas/vulcain/caddy
+  # 在此处添加额外的 Caddy 模块
+
+FROM dunglas/frankenphp AS runner
+
+# 将官方二进制文件替换为包含自定义模块的二进制文件
+COPY --from=builder /usr/local/bin/frankenphp /usr/local/bin/frankenphp
+```
+
+FrankenPHP 提供的 `builder` 镜像包含 libphp 的编译版本。
+[用于构建的镜像](https://hub.docker.com/r/dunglas/frankenphp/tags?name=builder) 适用于所有版本的 FrankenPHP 和 PHP，包括 Alpine 和 Debian。
+
+> [!TIP]
+>
+> 如果你的系统基于 musl libc（Alpine Linux 上默认使用）并搭配 Symfony 使用，
+> 您可能需要 [增加默认堆栈大小](compile.md#使用-xcaddy)。
+
+## 默认启用 worker 模式
+
+设置 `FRANKENPHP_CONFIG` 环境变量以使用 worker 脚本启动 FrankenPHP：
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# ...
+
+ENV FRANKENPHP_CONFIG="worker ./public/index.php"
+```
+
+## 开发挂载宿主机目录
+
+要使用 FrankenPHP 轻松开发，请从包含应用程序源代码的主机挂载目录作为 Docker 容器中的 volume：
+
+```console
+docker run -v $PWD:/app/public -p 80:80 -p 443:443 -p 443:443/udp --tty my-php-app
+```
+
+> [!TIP]
+>
+> `--tty` 选项允许使用清晰可读的日志，而不是 JSON 日志。
+
+使用 Docker Compose：
+
+```yaml
+# compose.yaml
+
+services:
+  php:
+    image: dunglas/frankenphp
+    # 如果要使用自定义 Dockerfile，请取消注释以下行
+    #build: .
+    # 如果要在生产环境中运行，请取消注释以下行
+    # restart: always
+    ports:
+      - "80:80" # HTTP
+      - "443:443" # HTTPS
+      - "443:443/udp" # HTTP/3
+    volumes:
+      - ./:/app/public
+      - caddy_data:/data
+      - caddy_config:/config
+    # 在生产环境中注释以下行，它允许在 dev 中使用清晰可读日志
+    tty: true
+
+# Caddy 证书和配置所需的挂载目录
+volumes:
+  caddy_data:
+  caddy_config:
+```
+
+## 以非 root 用户身份运行
+
+FrankenPHP 可以在 Docker 中以非 root 用户身份运行。
+
+下面是一个示例 Dockerfile：
+
+```dockerfile
+FROM dunglas/frankenphp
+
+ARG USER=www-data
+
+RUN \
+  # 在基于 alpine 的发行版使用 "adduser -D ${USER}"
+  useradd -D ${USER}; \
+  # 需要开放80和443端口的权限
+  setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/frankenphp; \
+  # 需要 /data/caddy 和 /config/caddy 目录的写入权限
+  chown -R ${USER}:${USER} /data/caddy && chown -R ${USER}:${USER} /config/caddy;
+
+USER ${USER}
+```
+
+## 更新
+
+Docker 镜像会按照以下条件更新：
+
+* 发布新的版本后
+* 每日 4:00（UTC 时间）检查新的 PHP 镜像
+
+## 开发版本
+
+可在此 [`dunglas/frankenphp-dev`](https://hub.docker.com/repository/docker/dunglas/frankenphp-dev) 仓库获取开发版本。
+每次在 GitHub 仓库的主分支有新的 commit 都会触发一次新的 build。
+
+`latest*` tag 指向最新的 `main` 分支，且同样支持 `sha-<git-commit-hash>` 的 tag。

docs/cn/early-hints.md

@@ -0,0 +1,21 @@
+# 早期提示
+
+FrankenPHP 原生支持 [103 Early Hints 状态码](https://developer.chrome.com/blog/early-hints/)。
+使用早期提示可以将网页的加载时间缩短 30%。
+
+```php
+<?php
+
+header('Link: </style.css>; rel=preload; as=style');
+headers_send(103);
+
+// 慢速算法和 SQL 查询
+
+echo <<<'HTML'
+<!DOCTYPE html>
+<title>Hello FrankenPHP</title>
+<link rel="stylesheet" href="style.css">
+HTML;
+```
+
+早期提示由普通模式和 [worker](worker.md) 模式支持。

docs/cn/embed.md

@@ -0,0 +1,132 @@
+# PHP 应用程序作为独立二进制文件
+
+FrankenPHP 能够将 PHP 应用程序的源代码和资源文件嵌入到静态的、独立的二进制文件中。
+
+由于这个特性，PHP 应用程序可以作为独立的二进制文件分发，包括应用程序本身、PHP 解释器和生产级 Web 服务器 Caddy。
+
+了解有关此功能的更多信息 [Kévin 在 SymfonyCon 上的演讲](https://dunglas.dev/2023/12/php-and-symfony-apps-as-standalone-binaries/)。
+
+## 准备你的应用
+
+在创建独立二进制文件之前，请确保应用已准备好进行打包。
+
+例如，您可能希望：
+
+* 给应用安装生产环境的依赖
+* 导出 autoloader
+* 如果可能，为应用启用生产模式
+* 丢弃不需要的文件，例如 `.git` 或测试文件，以减小最终二进制文件的大小
+
+例如，对于 Symfony 应用程序，您可以使用以下命令：
+
+```console
+# 导出项目以避免 .git/ 等目录
+mkdir $TMPDIR/my-prepared-app
+git archive HEAD | tar -x -C $TMPDIR/my-prepared-app
+cd $TMPDIR/my-prepared-app
+
+# 设置适当的环境变量
+echo APP_ENV=prod > .env.local
+echo APP_DEBUG=0 >> .env.local
+
+# 删除测试文件
+rm -Rf tests/
+
+# 安装依赖项
+composer install --ignore-platform-reqs --no-dev -a
+
+# 优化 .env
+composer dump-env prod
+```
+
+## 创建 Linux 二进制文件
+
+创建 Linux 二进制文件的最简单方法是使用我们提供的基于 Docker 的构建器。
+
+1. 在准备好的应用的存储库中创建一个名为 `static-build.Dockerfile` 的文件。
+
+    ```dockerfile
+    FROM --platform=linux/amd64 dunglas/frankenphp:static-builder
+
+    # 复制应用代码
+    WORKDIR /go/src/app/dist/app
+    COPY . .
+
+    # 构建静态二进制文件，只选择你需要的 PHP 扩展
+    WORKDIR /go/src/app/
+    RUN EMBED=dist/app/ \
+        PHP_EXTENSIONS=ctype,iconv,pdo_sqlite \
+        ./build-static.sh
+    ```
+
+    > [!CAUTION]
+    >
+    > 某些 .dockerignore 文件（例如默认的 [symfony-docker .dockerignore](https://github.com/dunglas/symfony-docker/blob/main/.dockerignore)）会忽略 vendor
+    > 文件夹和环境文件。在构建之前，请务必调整或删除 .dockerignore 文件。
+
+2. 构建:
+
+    ```console
+    docker build -t static-app -f static-build.Dockerfile .
+    ```
+
+3. 提取二进制文件
+
+    ```console
+    docker cp $(docker create --name static-app-tmp static-app):/go/src/app/dist/frankenphp-linux-x86_64 my-app ; docker rm static-app-tmp
+    ```
+
+生成的二进制文件是当前目录中名为 `my-app` 的文件。
+
+## 为其他操作系统创建二进制文件
+
+如果您不想使用 Docker，或者想要构建 macOS 二进制文件，你可以使用我们提供的 shell 脚本：
+
+```console
+git clone https://github.com/dunglas/frankenphp
+cd frankenphp
+EMBED=/path/to/your/app \
+    PHP_EXTENSIONS=ctype,iconv,pdo_sqlite \
+    ./build-static.sh
+```
+
+在 `dist/` 目录中生成的二进制文件名称为 `frankenphp-<os>-<arch>`。
+
+## 使用二进制文件
+
+就是这样！`my-app` 文件（或其他操作系统上的 `dist/frankenphp-<os>-<arch>`）包含您的独立应用程序！
+
+若要启动 Web 应用，请执行：
+
+```console
+./my-app php-server
+```
+
+如果您的应用包含 [worker 脚本](worker.md)，请使用如下命令启动 worker：
+
+```console
+./my-app php-server --worker public/index.php
+```
+
+要启用 HTTPS（自动创建 Let's Encrypt 证书）、HTTP/2 和 HTTP/3，请指定要使用的域名：
+
+```console
+./my-app php-server --domain localhost
+```
+
+您还可以运行二进制文件中嵌入的 PHP CLI 脚本：
+
+```console
+./my-app php-cli bin/console
+```
+
+## 自定义构建
+
+[阅读静态构建文档](static.md) 查看如何自定义二进制文件（扩展、PHP 版本等）。
+
+## 分发二进制文件
+
+创建的二进制文件不会被压缩。
+若要在发送文件之前减小文件的大小，可以对其进行压缩。
+
+我们推荐使用 `xz`。

docs/cn/github-actions.md

@@ -0,0 +1,31 @@
+# 使用 GitHub Actions
+
+此存储库构建 Docker 镜像并将其部署到 [Docker Hub](https://hub.docker.com/r/dunglas/frankenphp) 上
+每个批准的拉取请求或设置后在您自己的分支上。
+
+## 设置 GitHub Actions
+
+在存储库设置中的 `secrets` 下，添加以下字段：
+
+- `REGISTRY_LOGIN_SERVER`: 要使用的 docker registry（如 `docker.io`）。
+- `REGISTRY_USERNAME`: 用于登录 registry 的用户名（如 `dunglas`）。
+- `REGISTRY_PASSWORD`: 用于登录 registry 的密码（如 `access key`）。
+- `IMAGE_NAME`: 镜像的名称（如 `dunglas/frankenphp`）。
+
+## 构建和推送镜像
+
+1. 创建 Pull Request 或推送到你的 Fork 分支。
+2. GitHub Actions 将生成镜像并运行每项测试。
+3. 如果生成成功，则将使用 `pr-x` 推送 registry，其中 `x` 是 PR 编号，作为标记将镜像推送到注册表。
+
+## 部署镜像
+
+1. 合并 Pull Request 后，GitHub Actions 将再次运行测试并生成新镜像。
+2. 如果构建成功，则 Docker 注册表中的 `main` tag 将更新。
+
+## 发布
+
+1. 在项目仓库中创建新 Tag。
+2. GitHub Actions 将生成镜像并运行每项测试。
+3. 如果构建成功，镜像将使用标记名称作为标记推送到 registry（例如，将创建 `v1.2.3` 和 `v1.2`）。
+4. `latest` 标签也将更新。

docs/cn/known-issues.md

@@ -0,0 +1,99 @@
+# 已知问题
+
+## Fibers
+
+在 [Fibers](https://www.php.net/manual/en/language.fibers.php) 中调用 PHP 的函数和代码等语言结构，这些结构内部再调用 [cgo](https://go.dev/blog/cgo) 会导致崩溃。
+
+这个问题 [正在由 Go 项目处理](https://github.com/golang/go/issues/62130)。
+
+一种解决方案是不要使用从 Fibers 内部委托给 Go 的构造（如 `echo`）和函数（如 `header()`）。
+
+下面的代码可能会崩溃，因为它在 Fiber 中使用了 `echo`：
+
+```php
+$fiber = new Fiber(function() {
+    echo 'In the Fiber'.PHP_EOL;
+    echo 'Still inside'.PHP_EOL;
+});
+$fiber->start();
+```
+
+相反，请从 Fiber 返回值并在外部使用它：
+
+```php
+$fiber = new Fiber(function() {
+    Fiber::suspend('In the Fiber'.PHP_EOL));
+    Fiber::suspend('Still inside'.PHP_EOL));
+});
+echo $fiber->start();
+echo $fiber->resume();
+$fiber->resume();
+```
+
+## 不支持的 PHP 扩展
+
+已知以下扩展与 FrankenPHP 不兼容：
+
+| 名称                                                        | 原因          | 替代方案                                                                                                                 |
+| ----------------------------------------------------------- | --------------- |----------------------------------------------------------------------------------------------------------------------|
+| [imap](https://www.php.net/manual/en/imap.installation.php) | 非线程安全 | [javanile/php-imap2](https://github.com/javanile/php-imap2), [webklex/php-imap](https://github.com/Webklex/php-imap) |
+
+## get_browser
+
+[get_browser()](https://www.php.net/manual/en/function.get-browser.php) 函数在一段时间后似乎表现不佳。解决方法是缓存（例如使用 [APCu](https://www.php.net/manual/zh/book.apcu.php)）每个 User-Agent，因为它们是不变的。
+
+## 独立的二进制和基于 Alpine 的 Docker 镜像
+
+独立的二进制文件和基于 Alpine 的 docker 镜像 (`dunglas/frankenphp:*-alpine`) 使用的是 [musl libc](https://musl.libc.org/) 而不是 [glibc and friends](https://www.etalabs.net/compare_libcs.html)，为的是保持较小的二进制大小。
+这可能会导致一些兼容性问题。特别是，glob 标志 `GLOB_BRACE` [不可用](https://www.php.net/manual/en/function.glob.php)。
+
+## 在 Docker 中使用 `https://127.0.0.1`
+
+默认情况下，FrankenPHP 会为 `localhost` 生成一个 TLS 证书。
+这是本地开发最简单且推荐的选项。
+
+如果确实想使用 `127.0.0.1` 作为主机，可以通过将服务器名称设置为 `127.0.0.1` 来配置它以为其生成证书。
+
+如果你使用 Docker，因为 [Docker 网络](https://docs.docker.com/network/) 问题，只做这些是不够的。
+您将收到类似于以下内容的 TLS 错误 `curl: (35) LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error`。
+
+如果你使用的是 Linux，解决方案是使用 [使用宿主机网络](https://docs.docker.com/network/network-tutorial-host/)：
+
+```console
+docker run \
+    -e SERVER_NAME="127.0.0.1" \
+    -v $PWD:/app/public \
+    --network host \
+    dunglas/frankenphp
+```
+
+Mac 和 Windows 不支持 Docker 使用宿主机网络。在这些平台上，您必须猜测容器的 IP 地址并将其包含在服务器名称中。
+
+运行 `docker network inspect bridge` 并查看 `Containers`，找到 `IPv4Address` 当前分配的最后一个 IP 地址，并增加 1。如果没有容器正在运行，则第一个分配的 IP 地址通常为 `172.17.0.2`。
+
+然后将其包含在 `SERVER_NAME` 环境变量中：
+
+```console
+docker run \
+    -e SERVER_NAME="127.0.0.1, 172.17.0.3" \
+    -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+> [!CAUTION]
+>
+> 请务必将 `172.17.0.3` 替换为将分配给容器的 IP。
+
+您现在应该能够从主机访问 `https://127.0.0.1`。
+
+如果不是这种情况，请在调试模式下启动 FrankenPHP 以尝试找出问题：
+
+```console
+docker run \
+    -e CADDY_GLOBAL_OPTIONS="debug" \
+    -e SERVER_NAME="127.0.0.1" \
+    -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```

docs/cn/laravel.md

@@ -0,0 +1,74 @@
+# Laravel
+
+## Docker
+
+使用 FrankenPHP 为 [Laravel](https://laravel.com) Web 应用程序提供服务就像将项目挂载到官方 Docker 镜像的 `/app` 目录中一样简单。
+
+从 Laravel 应用程序的主目录运行以下命令：
+
+```console
+docker run -p 80:80 -p 443:443 -p 443:443/udp -v $PWD:/app dunglas/frankenphp
+```
+
+尽情享受吧！
+
+## 本地安装
+
+或者，你可以从本地机器上使用 FrankenPHP 运行 Laravel 项目：
+
+1. [下载与您的系统相对应的二进制文件](https://github.com/dunglas/frankenphp/releases)
+2. 将以下配置添加到 Laravel 项目根目录中名为 `Caddyfile` 的文件中：
+
+    ```caddyfile
+    {
+    	frankenphp
+    }
+
+    # 服务器的域名
+    localhost {
+    	# 将 webroot 设置为 public/ 目录
+    	root * public/
+    	# 启用压缩(可选)
+    	encode zstd br gzip
+    	# 执行当前目录中的 PHP 文件并提供资产
+    	php_server
+    }
+    ```
+
+3. 从 Laravel 项目的根目录启动 FrankenPHP：`./frankenphp run`
+
+## Laravel Octane
+
+Octane 可以通过 Composer 包管理器安装：
+
+```console
+composer require laravel/octane
+```
+
+安装 Octane 后，您可以执行 `octane:install` Artisan 命令，该命令会将 Octane 的配置文件安装到您的应用程序中：
+
+```console
+php artisan octane:install --server=frankenphp
+```
+
+Octane 服务可以通过 `octane:frankenphp` Artisan 命令启动。
+
+```console
+php artisan octane:frankenphp
+```
+
+`octane:frankenphp` 命令可以采用以下选项：
+
+* `--host`: 服务器应绑定到的 IP 地址（默认值: `127.0.0.1`）
+* `--port`: 服务器应可用的端口（默认值: `8000`）
+* `--admin-port`: 管理服务器应可用的端口（默认值: `2019`）
+* `--workers`: 应可用于处理请求的 worker 数（默认值: `auto`）
+* `--max-requests`: 在 worker 重启之前要处理的请求数（默认值: `500`）
+* `--caddyfile`: FrankenPHP `Caddyfile` 文件的路径
+* `--https`: 开启 HTTPS、HTTP/2 和 HTTP/3，自动生成和延长证书
+* `--http-redirect`: 启用 HTTP 到 HTTPS 重定向（仅在使用 `--https` 时启用）
+* `--watch`: 修改应用程序时自动重新加载服务器
+* `--poll`: 在监视时使用文件系统轮询，以便通过网络监视文件
+* `--log-level`: 在指定日志级别或高于指定日志级别的日志消息
+
+你可以了解更多关于 [Laravel Octane 官方文档](https://laravel.com/docs/octane)。

docs/cn/mercure.md

@@ -0,0 +1,12 @@
+# 实时
+
+FrankenPHP 带有一个内置的 Mercure Hub！
+Mercure 允许将事件实时推送到所有连接的设备：它们将立即收到 JavaScript 事件。
+
+无需 JS 库或 SDK！
+
+![Mercure](../mercure-hub.png)
+
+要启用 Mercure Hub，请按照 [Mercure 网站](https://mercure.rocks/docs/hub/config) 中的说明更新 `Caddyfile`。
+
+要从您的代码中推送 Mercure 更新，我们推荐 [Symfony Mercure Component](https://symfony.com/components/Mercure)（不需要 Symfony 框架来使用）。

docs/cn/production.md

@@ -0,0 +1,141 @@
+# 在生产环境中部署
+
+在本教程中，我们将学习如何使用 Docker Compose 在单个服务器上部署 PHP 应用程序。
+
+如果您使用的是 Symfony，请阅读 Symfony Docker 项目（使用 FrankenPHP）的 [在生产环境中部署](https://github.com/dunglas/symfony-docker/blob/main/docs/production.md) 文档条目。
+
+如果您使用的是 API Platform（同样使用 FrankenPHP），请参阅 [框架的部署文档](https://api-platform.com/docs/deployment/)。
+
+## 准备应用
+
+首先，在 PHP 项目的根目录中创建一个 `Dockerfile`：
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# 请将 "your-domain-name.example.com" 替换为您的域名
+ENV SERVER_NAME=your-domain-name.example.com
+# 如果要禁用 HTTPS，请改用以下值：
+#ENV SERVER_NAME=:80
+
+# 启用 PHP 生产配置
+RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
+
+# 将项目的 PHP 文件复制到 public 目录中
+COPY . /app/public
+# 如果你使用 Symfony 或 Laravel，你需要复制整个项目：
+#COPY . /app
+```
+
+有关更多详细信息和选项，请参阅 [构建自定义 Docker 镜像](docker.md)。
+要了解如何自定义配置，请安装 PHP 扩展和 Caddy 模块。
+
+如果您的项目使用 Composer，
+请务必将其包含在 Docker 镜像中并安装您的依赖。
+
+然后，添加一个 `compose.yaml` 文件：
+
+```yaml
+services:
+  php:
+    image: dunglas/frankenphp
+    restart: always
+    ports:
+      - "80:80" # HTTP
+      - "443:443" # HTTPS
+      - "443:443/udp" # HTTP/3
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+
+# Caddy 证书和配置所需的挂载目录
+volumes:
+  caddy_data:
+  caddy_config:
+```
+
+> [!NOTE]
+>
+> 前面的示例适用于生产用途。
+> 在开发中，你可能希望使用挂载目录，不同的 PHP 配置和不同的 `SERVER_NAME` 环境变量值。
+>
+> 见 [Symfony Docker](https://github.com/dunglas/symfony-docker) 项目
+> （使用 FrankenPHP）作为使用多阶段镜像的更高级示例，
+> Composer、额外的 PHP 扩展等。
+
+最后，如果您使用 Git，请提交这些文件并推送。
+
+## 准备服务器
+
+若要在生产环境中部署应用程序，需要一台服务器。
+在本教程中，我们将使用 DigitalOcean 提供的虚拟机，但任何 Linux 服务器都可以工作。
+如果您已经有安装了 Docker 的 Linux 服务器，您可以直接跳到 [下一节](#配置域名)。
+
+否则，请使用 [此会员链接](https://m.do.co/c/5d8aabe3ab80) 获得 200 美元的免费信用额度，创建一个帐户，然后单击“Create a Droplet”。
+然后，单击“Choose an image”部分下的“Marketplace”选项卡，然后搜索名为“Docker”的应用程序。
+这将配置已安装最新版本的 Docker 和 Docker Compose 的 Ubuntu 服务器！
+
+出于测试目的，最便宜的就足够了。
+对于实际的生产用途，您可能需要在“general purpose”部分中选择一个计划来满足您的需求。
+
+![使用 Docker 在 DigitalOcean 上部署 FrankenPHP](../digitalocean-droplet.png)
+
+您可以保留其他设置的默认值，也可以根据需要进行调整。
+不要忘记添加您的 SSH 密钥或创建密码，然后点击“完成并创建”按钮。
+
+然后，在 Droplet 预配时等待几秒钟。
+Droplet 准备就绪后，使用 SSH 进行连接：
+
+```console
+ssh root@<droplet-ip>
+```
+
+## 配置域名
+
+在大多数情况下，您需要将域名与您的网站相关联。
+如果您还没有域名，则必须通过注册商购买。
+
+然后为您的域名创建类型为 `A` 的 DNS 记录，指向服务器的 IP 地址：
+
+```dns
+your-domain-name.example.com.  IN  A     207.154.233.113
+```
+
+DigitalOcean 域服务示例（“Networking” > “Domains”）：
+
+![在 DigitalOcean 上配置 DNS](../digitalocean-dns.png)
+
+> [!NOTE]
+>
+> Let's Encrypt 是 FrankenPHP 默认用于自动生成 TLS 证书的服务，不支持使用裸 IP 地址。使用域名是使用 Let's Encrypt 的必要条件。
+
+## 部署
+
+使用 `git clone`、`scp` 或任何其他可能适合您需要的工具在服务器上复制您的项目。
+如果使用 GitHub，则可能需要使用 [部署密钥](https://docs.github.com/en/free-pro-team@latest/developers/overview/managing-deploy-keys#deploy-keys)。
+部署密钥也 [由 GitLab 支持](https://docs.gitlab.com/ee/user/project/deploy_keys/)。
+
+Git 示例：
+
+```console
+git clone git@github.com:<username>/<project-name>.git
+```
+
+进入包含项目 (`<project-name>`) 的目录，并在生产模式下启动应用：
+
+```console
+docker compose up -d --wait
+```
+
+您的服务器已启动并运行，并且已自动为您生成 HTTPS 证书。
+去 `https://your-domain-name.example.com` 享受吧！
+
+> [!CAUTION]
+>
+> Docker 有一个缓存层，请确保每个部署都有正确的构建，或者使用 --no-cache 选项重新构建项目以避免缓存问题。
+
+## 在多个节点上部署
+
+如果要在计算机集群上部署应用程序，可以使用 [Docker Swarm](https://docs.docker.com/engine/swarm/stack-deploy/)，
+它与提供的 Compose 文件兼容。
+要在 Kubernetes 上部署，请查看 [API 平台提供的 Helm 图表](https://api-platform.com/docs/deployment/kubernetes/)，同样也使用 FrankenPHP。

docs/cn/static.md

@@ -0,0 +1,81 @@
+# 创建静态构建
+
+基于 [static-php-cli](https://github.com/crazywhalecc/static-php-cli) 项目（这个项目支持所有 SAPI，不仅仅是 `cli`），
+FrankenPHP 已支持创建静态二进制，无需安装本地 PHP。
+
+使用这种方法，我们可构建一个包含 PHP 解释器、Caddy Web 服务器和 FrankenPHP 的可移植二进制文件！
+
+FrankenPHP 还支持 [将 PHP 应用程序嵌入到静态二进制文件中](embed.md)。
+
+## Linux
+
+我们提供了一个 Docker 镜像来构建 Linux 静态二进制文件：
+
+```console
+docker buildx bake --load static-builder
+docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/dist/frankenphp-linux-$(uname -m) frankenphp ; docker rm static-builder
+```
+
+生成的静态二进制文件名为 `frankenphp`，可在当前目录中找到。
+
+如果您想在没有 Docker 的情况下构建静态二进制文件，请查看 macOS 说明，它也适用于 Linux。
+
+### 自定义扩展
+
+默认情况下，大多数流行的 PHP 扩展都会被编译。
+
+若要减小二进制文件的大小并减少攻击面，可以选择使用 `PHP_EXTENSIONS` Docker 参数来自定义构建的扩展。
+
+例如，运行以下命令以生成仅包含 `opcache,pdo_sqlite` 扩展的二进制：
+
+```console
+docker buildx bake --load --set static-builder.args.PHP_EXTENSIONS=opcache,pdo_sqlite static-builder
+# ...
+```
+
+若要将启用其他功能的库添加到已启用的扩展中，可以使用 `PHP_EXTENSION_LIBS` Docker 参数：
+
+```console
+docker buildx bake \
+  --load \
+  --set static-builder.args.PHP_EXTENSIONS=gd \
+  --set static-builder.args.PHP_EXTENSION_LIBS=libjpeg,libwebp \
+  static-builder
+```
+
+参见：[自定义构建](#自定义构建)
+
+### GitHub Token
+
+如果遇到了 GitHub API 速率限制，请在 `GITHUB_TOKEN` 的环境变量中设置 GitHub Personal Access Token：
+
+```console
+GITHUB_TOKEN="xxx" docker --load buildx bake static-builder
+# ...
+```
+
+## macOS
+
+运行以下脚本以创建适用于 macOS 的静态二进制文件（需要先安装 [Homebrew](https://brew.sh/)）：
+
+```console
+git clone https://github.com/dunglas/frankenphp
+cd frankenphp
+./build-static.sh
+```
+
+注意：此脚本也适用于 Linux（可能也适用于其他 Unix 系统），我们提供的用于构建静态二进制的 Docker 镜像也在内部使用这个脚本。
+
+## 自定义构建
+
+以下环境变量可以传递给 `docker build` 和 `build-static.sh`
+脚本来自定义静态构建：
+
+* `FRANKENPHP_VERSION`: 要使用的 FrankenPHP 版本
+* `PHP_VERSION`: 要使用的 PHP 版本
+* `PHP_EXTENSIONS`: 要构建的 PHP 扩展（[支持的扩展列表](https://static-php.dev/zh/guide/extensions.html)）
+* `PHP_EXTENSION_LIBS`: 要构建的额外库，为扩展添加额外的功能
+* `EMBED`: 要嵌入二进制文件的 PHP 应用程序的路径
+* `CLEAN`: 设置后，libphp 及其所有依赖项都是重新构建的（不使用缓存）
+* `DEBUG_SYMBOLS`: 设置后，调试符号将被保留在二进制文件内
+* `RELEASE`: （仅限维护者）设置后，生成的二进制文件将上传到 GitHub 上

docs/cn/worker.md

@@ -0,0 +1,114 @@
+# 使用 FrankenPHP Workers
+
+启动应用程序一次并将其保存在内存中。
+FrankenPHP 将在几毫秒内处理传入的请求。
+
+## 启动 Worker 脚本
+
+### Docker
+
+将 `FRANKENPHP_CONFIG` 环境变量的值设置为 `worker /path/to/your/worker/script.php`：
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker /app/path/to/your/worker/script.php" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+### 独立二进制
+
+使用 `php-server` 命令的 `--worker` 选项， 执行命令使当前目录的内容使用 worker：
+
+```console
+./frankenphp php-server --worker /path/to/your/worker/script.php
+```
+
+## Symfony Runtime
+
+FrankenPHP 的 worker 模式由 [Symfony Runtime 组件](https://symfony.com/doc/current/components/runtime.html) 支持。
+要在 worker 中启动任何 Symfony 应用程序，请安装 [PHP Runtime](https://github.com/php-runtime/runtime) 的 FrankenPHP 软件包：
+
+```console
+composer require runtime/frankenphp-symfony
+```
+
+通过定义 `APP_RUNTIME` 环境变量来启动你的应用服务器，以使用 FrankenPHP Symfony Runtime：
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php" \
+    -e APP_RUNTIME=Runtime\\FrankenPhpSymfony\\Runtime \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+## Laravel Octane
+
+请参阅 [文档](laravel.md#laravel-octane)。
+
+## 自定义应用程序
+
+以下示例演示如何在不依赖第三方库的情况下创建自己的 worker 脚本：
+
+```php
+<?php
+// public/index.php
+
+// 防止在客户端连接中断时 worker 线程脚本终止
+ignore_user_abort(true);
+
+// 启动应用
+require __DIR__.'/vendor/autoload.php';
+
+$myApp = new \App\Kernel();
+$myApp->boot();
+
+// 循环外的处理程序以获得更好的性能（减少工作量）
+$handler = static function () use ($myApp) {
+    // 收到请求时调用
+    // 超全局变量 php://input
+    echo $myApp->handle($_GET, $_POST, $_COOKIE, $_FILES, $_SERVER);
+};
+for ($nbRequests = 0, $running = true; isset($_SERVER['MAX_REQUESTS']) && ($nbRequests < ((int)$_SERVER['MAX_REQUESTS'])) && $running; ++$nbRequests) {
+    $running = \frankenphp_handle_request($handler);
+
+    // 发送 HTTP 响应后执行某些操作
+    $myApp->terminate();
+
+    // 调用垃圾回收器以减少在页面生成过程中触发垃圾回收器的几率
+    gc_collect_cycles();
+}
+// 结束清理
+$myApp->shutdown();
+```
+
+然后，启动应用并使用 `FRANKENPHP_CONFIG` 环境变量来配置你的 worker：
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+默认情况下，每个 CPU 启动一个 worker。
+您还可以配置要启动的 worker 数：
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php 42" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+### 在一定数量的请求后重新启动 Worker
+
+由于 PHP 最初不是为长时间运行的进程而设计的，因此仍然有许多库和遗留代码会发生内存泄露。
+在 worker 模式下使用此类代码的解决方法是在处理一定数量的请求后重新启动 worker 程序脚本：
+
+前面的 worker 代码段允许通过设置名为 `MAX_REQUESTS` 的环境变量来配置要处理的最大请求数。

docs/compile.md

@@ -1,22 +1,23 @@
 # Compile From Sources
 
-This document explain how to create a FrankenPHP build that will load PHP as a dymanic library.
+This document explains how to create a FrankenPHP binary that will load PHP as a dynamic library.
 This is the recommended method.
 
-Alternatively, [creating static builds](static.md) is also possible.
+Alternatively, [static builds](static.md) can also be created.
 
 ## Install PHP
 
-FrankenPHP is compatible with the PHP 8.2 and superior.
+FrankenPHP is compatible with PHP 8.2 and superior.
 
-First, [get the sources of PHP](https://www.php.net/downloads.php) and extract them:
+First, [get the PHP sources](https://www.php.net/downloads.php) and extract them:
 
 ```console
 tar xf php-*
 cd php-*/
 ```
 
-Then, configure PHP for your platform:
+Then, run the `configure` script with the options needed for your platform.
+Th following `./configure` flags are mandatory, but you can add others, for example to compile extensions or additional features.
 
 ### Linux
 
@@ -28,13 +29,6 @@ Then, configure PHP for your platform:
     --enable-zend-max-execution-timers
 ```
 
-Finally, compile and install PHP:
-
-```console
-make -j$(nproc)
-sudo make install
-```
-
 ### Mac
 
 Use the [Homebrew](https://brew.sh/) package manager to install
@@ -58,22 +52,21 @@ Then run the configure script:
     --with-iconv=/opt/homebrew/opt/libiconv/
 ```
 
-These flags are required, but you can add other flags (e.g. extra extensions)
-if needed.
+## Compile PHP
 
 Finally, compile and install PHP:
 
 ```console
-make -j$(sysctl -n hw.logicalcpu)
+make -j"$(getconf _NPROCESSORS_ONLN)"
 sudo make install
 ```
 
 ## Compile the Go App
 
-You can now use the Go library and compile our Caddy build:
+You can now build the final binary:
 
 ```console
-curl -L https://github.com/dunglas/frankenphp/archive/refs/heads/main.tar.gz | tar x
+curl -L https://github.com/dunglas/frankenphp/archive/refs/heads/main.tar.gz | tar xz
 cd frankenphp-main/caddy/frankenphp
 CGO_CFLAGS=$(php-config --includes) CGO_LDFLAGS="$(php-config --ldflags) $(php-config --libs)" go build
 ```
@@ -88,6 +81,7 @@ XCADDY_GO_BUILD_FLAGS="-ldflags '-w -s'" \
 xcaddy build \
     --output frankenphp \
     --with github.com/dunglas/frankenphp/caddy \
+    --with github.com/dunglas/caddy-cbrotli \
     --with github.com/dunglas/mercure/caddy \
     --with github.com/dunglas/vulcain/caddy
     # Add extra Caddy modules here

docs/config.md

@@ -2,21 +2,25 @@
 
 FrankenPHP, Caddy as well as the Mercure and Vulcain modules can be configured using [the formats supported by Caddy](https://caddyserver.com/docs/getting-started#your-first-config).
 
-In the Docker image, the `Caddyfile` is located at `/etc/caddy/Caddyfile`.
+In [the Docker images](docker.md), the `Caddyfile` is located at `/etc/caddy/Caddyfile`.
 
 You can also configure PHP using `php.ini` as usual.
 
-In the Docker image, the `php.ini` file is not present, you can create it or `COPY` manually.
-
-If you copy `php.ini` from `$PHP_INI_DIR/php.ini-production` or `$PHP_INI_DIR/php.ini-development`, you also must set the variable `variables_order = "EGPCS"`, because the default value for `variables_order` is `"EGPCS"`, but in `php.ini-production` and `php.ini-development` we have `"GPCS"`. And in this case, `worker` does not work properly.
+In the Docker images, the `php.ini` file is not present, you can create it manually  or copy an official template:
 
 ```dockerfile
 FROM dunglas/frankenphp
 
-RUN cp $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini; \
-    sed -i 's/variables_order = "GPCS"/variables_order = "EGPCS"/' $PHP_INI_DIR/php.ini;
+# Developement:
+RUN cp $PHP_INI_DIR/php.ini-development $PHP_INI_DIR/php.ini
+
+# Or production:
+RUN cp $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
 ```
 
+The static binary will look for a `php.ini` file in the current working directory,
+in `/lib/` as well as [the other standard locations](https://www.php.net/manual/en/configuration.file.php).
+
 ## Caddyfile Config
 
 To register the FrankenPHP executor, the `frankenphp` [global option](https://caddyserver.com/docs/caddyfile/concepts#global-options) must be set, then the `php_server` or the `php` [HTTP directives](https://caddyserver.com/docs/caddyfile/concepts#directives) may be used within the site blocks to serve your PHP app.
@@ -27,8 +31,6 @@ Minimal example:
 {
 	# Enable FrankenPHP
 	frankenphp
-	# Configure when the directive must be executed
-	order php_server before file_server
 }
 
 localhost {
@@ -87,7 +89,8 @@ other.example.com {
 	root * /path/to/other/public
 	php_server
 }
-...
+
+# ...
 ```
 
 Using the `php_server` directive is generally what you need,
@@ -121,12 +124,39 @@ The `php_server` and the `php` directives have the following options:
 ```caddyfile
 php_server [<matcher>] {
 	root <directory> # Sets the root folder to the site. Default: `root` directive.
-	split_path <delim...> # Sets the substrings for splitting the URI into two parts. The first matching substring will be used to split the "path info" from the path. The first piece is suffixed with the matching substring and will be assumed as the actual resource (CGI script) name. The second piece will be set to PATH_INFO for the CGI script to use. Default: `.php`
-	resolve_root_symlink # Enables resolving the `root` directory to its actual value by evaluating a symbolic link, if one exists.
+	split_path <delim...> # Sets the substrings for splitting the URI into two parts. The first matching substring will be used to split the "path info" from the path. The first piece is suffixed with the matching substring and will be assumed as the actual resource (CGI script) name. The second piece will be set to PATH_INFO for the script to use. Default: `.php`
+	resolve_root_symlink false # Disables resolving the `root` directory to its actual value by evaluating a symbolic link, if one exists (enabled by default).
 	env <key> <value> # Sets an extra environment variable to the given value. Can be specified more than once for multiple environment variables.
+	file_server off # Disables the built-in file_server directive.
 }
 ```
 
+### Full Duplex (HTTP/1)
+
+When using HTTP/1.x, it may be desirable to enable full-duplex mode to allow writing a response before the entire body
+has been read. (for example: WebSocket, Server-Sent Events, etc.)
+
+This is an opt-in configuration that needs to be added to the global options in the `Caddyfile`:
+
+```caddyfile
+{
+  servers {
+    enable_full_duplex
+  }
+}
+```
+
+> ![CAUTION]
+>
+> Enabling this option may cause old HTTP/1.x clients that don't support full-duplex to deadlock.
+This can also be configured using the `CADDY_GLOBAL_OPTIONS` environment config:
+
+```sh
+CADDY_GLOBAL_OPTIONS="servers { enable_full_duplex }"
+```
+
+You can find more information about this setting in the [Caddy documentation](https://caddyserver.com/docs/caddyfile/options#enable-full-duplex).
+
 ## Environment Variables
 
 The following environment variables can be used to inject Caddy directives in the `Caddyfile` without modifying it:
@@ -135,9 +165,9 @@ The following environment variables can be used to inject Caddy directives in th
 * `CADDY_GLOBAL_OPTIONS`: inject [global options](https://caddyserver.com/docs/caddyfile/options)
 * `FRANKENPHP_CONFIG`: inject config under the `frankenphp` directive
 
-Unlike with FPM and CLI SAPIs, environment variables are **not** exposed by default in superglobals `$_SERVER` and `$_ENV`.
+As for FPM and CLI SAPIs, environment variables are exposed by default in the `$_SERVER` superglobal.
 
-To propagate environment variables to `$_SERVER` and `$_ENV`, set the `php.ini` `variables_order` directive to `EGPCS`.
+The `S` value of [the `variables_order` PHP directive](https://www.php.net/manual/en/ini.core.php#ini.variables-order) is always equivalent to `ES` regardless of the placement of `E` elsewhere in this directive.
 
 ## PHP config
 

docs/docker.md

@@ -1,6 +1,15 @@
 # Building Custom Docker Image
 
-[FrankenPHP Docker images](https://hub.docker.com/r/dunglas/frankenphp) are based on [official PHP images](https://hub.docker.com/_/php/). Alpine Linux and Debian variants are provided for popular architectures. Variants for PHP 8.2 and PHP 8.3 are provided. [Browse tags](https://hub.docker.com/r/dunglas/frankenphp/tags).
+[FrankenPHP Docker images](https://hub.docker.com/r/dunglas/frankenphp) are based on [official PHP images](https://hub.docker.com/_/php/). Debian and Alpine Linux variants are provided for popular architectures. Debian variants are recommended.
+
+Variants for PHP 8.2 and PHP 8.3 are provided.
+
+The tags follow this pattern: `dunglas/frankenphp:<frankenphp-version>-php<php-version>-<os>`
+
+* `<frankenphp-version>` and `<php-version>` are version numbers of FrankenPHP and PHP respectively, with specifities ranging from major (e.g. `1`), minor (e.g. `1.2`) to patch versions (e.g. `1.2.3`).
+* `<os>` is either `bookworm` (for Debian Bookworm) or `alpine` (for the latest stable version of Alpine).
+
+[Browse tags](https://hub.docker.com/r/dunglas/frankenphp/tags).
 
 ## How to Use The Images
 
@@ -12,7 +21,7 @@ FROM dunglas/frankenphp
 COPY . /app/public
 ```
 
-Then, run the commands to build and run the Docker image:
+Then, run these commands to build and run the Docker image:
 
 ```console
 docker build -t my-php-app .
@@ -54,6 +63,7 @@ RUN xcaddy build \
 	--output /usr/local/bin/frankenphp \
 	--with github.com/dunglas/frankenphp=./ \
 	--with github.com/dunglas/frankenphp/caddy=./caddy/ \
+	--with github.com/dunglas/caddy-cbrotli \
 	# Mercure and Vulcain are included in the official build, but feel free to remove them
 	--with github.com/dunglas/mercure/caddy \
 	--with github.com/dunglas/vulcain/caddy
@@ -65,8 +75,8 @@ FROM dunglas/frankenphp AS runner
 COPY --from=builder /usr/local/bin/frankenphp /usr/local/bin/frankenphp
 ```
 
-The `builder` image provided by FrankenPHP contains a compiled version of libphp.
-[Builders images](https://hub.docker.com/r/dunglas/frankenphp/tags?name=builder) are provided for all versions of FrankenPHP and PHP, both for Alpine and Debian.
+The `builder` image provided by FrankenPHP contains a compiled version of `libphp`.
+[Builders images](https://hub.docker.com/r/dunglas/frankenphp/tags?name=builder) are provided for all versions of FrankenPHP and PHP, both for Debian and Alpine.
 
 > [!TIP]
 >
@@ -128,7 +138,7 @@ volumes:
 
 ## Running as a Non-Root User
 
-FrankenPHP can run as non root user in Docker.
+FrankenPHP can run as non-root user in Docker.
 
 Here is a sample `Dockerfile` doing this:
 
@@ -136,11 +146,56 @@ Here is a sample `Dockerfile` doing this:
 FROM dunglas/frankenphp
 
 ARG USER=www-data
-USER ${USER}
 
-RUN adduser -D ${USER} \
-	# Caddy requires an additional capability to bind to port 80 and 443
-	setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/frankenphp
-	# Caddy requires write access to /data/caddy and /config/caddy
-	RUN chown -R ${USER}:${USER} /data/caddy && chown -R ${USER}:${USER} /config/caddy
+RUN \
+	# Use "adduser -D ${USER}" for alpine based distros
+	useradd -D ${USER}; \
+	# Add additional capability to bind to port 80 and 443
+	setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/frankenphp; \
+	# Give write access to /data/caddy and /config/caddy
+	chown -R ${USER}:${USER} /data/caddy && chown -R ${USER}:${USER} /config/caddy
+
+USER ${USER}
 ```
+
+### Running With No Capabilities
+
+Even when running rootless, FrankenPHP needs the `CAP_NET_BIND_SERVICE` capability to bind the
+web server on privileged ports (80 and 443).
+
+If you expose FrankenPHP on a non-privileged port (1024 and above), it's possible to run
+the webserver as a non-root user, and without the need for any capability:
+
+```dockerfile
+FROM dunglas/frankenphp
+
+ARG USER=www-data
+
+RUN \
+	# Use "adduser -D ${USER}" for alpine based distros
+	useradd -D ${USER}; \
+	# Remove default capability
+	setcap -r /usr/local/bin/frankenphp; \
+	# Give write access to /data/caddy and /config/caddy
+	chown -R ${USER}:${USER} /data/caddy && chown -R ${USER}:${USER} /config/caddy
+
+USER ${USER}
+```
+
+Next, set the `SERVER_NAME` environment variable to use an unprivileged port.
+Example: `:8000`
+
+## Updates
+
+The Docker images are built:
+
+* when a new release is tagged
+* daily at 4 am UTC, if new versions of the official PHP images are available
+
+## Development Versions
+
+Development versions are available in the [`dunglas/frankenphp-dev`](https://hub.docker.com/repository/docker/dunglas/frankenphp-dev) Docker repository.
+A new build is triggered every time a commit is pushed to the main branch of the GitHub repository.
+
+The `latest*` tags point to the head of the `main` branch.
+Tags of the form `sha-<git-commit-hash>` are also available.

docs/embed.md

@@ -2,20 +2,22 @@
 
 FrankenPHP has the ability to embed the source code and assets of PHP applications in a static, self-contained binary.
 
-Thanks to this feature, PHP applications can be distributed as standalone binaries that include the application itself, the PHP interpreter and Caddy, a production-level web server.
+Thanks to this feature, PHP applications can be distributed as standalone binaries that include the application itself, the PHP interpreter, and Caddy, a production-level web server.
 
-Learn more about this feature [in the presentation made by Kévin at SymfonyCon](https://dunglas.dev/2023/12/php-and-symfony-apps-as-standalone-binaries/).
+Learn more about this feature [in the presentation made by Kévin at SymfonyCon 2023](https://dunglas.dev/2023/12/php-and-symfony-apps-as-standalone-binaries/).
+
+For embedding Laravel applications, [read this specific documentation entry](laravel.md#laravel-apps-as-standalone-binaries).
 
 ## Preparing Your App
 
 Before creating the self-contained binary be sure that your app is ready for embedding.
 
-For instance you likely want to:
+For instance, you likely want to:
 
 * Install the production dependencies of the app
 * Dump the autoloader
 * Enable the production mode of your application (if any)
-* Strip uneeded files such as `.git` or tests to reduce the size of your final binary
+* Strip unneeded files such as `.git` or tests to reduce the size of your final binary
 
 For instance, for a Symfony app, you can use the following commands:
 
@@ -29,7 +31,8 @@ cd $TMPDIR/my-prepared-app
 echo APP_ENV=prod > .env.local
 echo APP_DEBUG=0 >> .env.local
 
-# Remove the tests
+# Remove the tests and other unneeded files to save space
+# Alternatively, add these files with the export-ignore attribute in your .gitattributes file
 rm -Rf tests/
 
 # Install the dependencies
@@ -39,11 +42,16 @@ composer install --ignore-platform-reqs --no-dev -a
 composer dump-env prod
 ```
 
+### Customizing the Configuration
+
+To customize [the configuration](config.md), you can put a `Caddyfile` as well as a `php.ini` file
+in the main directory of the app to be embedded (`$TMPDIR/my-prepared-app` in the previous example).
+
 ## Creating a Linux Binary
 
 The easiest way to create a Linux binary is to use the Docker-based builder we provide.
 
-1. Create a file named `static-build.Dockerfile` in the repository of your prepared app:
+1. Create a file named `static-build.Dockerfile` in the repository of your app:
 
     ```dockerfile
     FROM --platform=linux/amd64 dunglas/frankenphp:static-builder
@@ -52,20 +60,23 @@ The easiest way to create a Linux binary is to use the Docker-based builder we p
     WORKDIR /go/src/app/dist/app
     COPY . .
 
-    # Build the static binary, be sure to select only the PHP extensions you want
+    # Build the static binary
     WORKDIR /go/src/app/
-    RUN EMBED=dist/app/ \
-        PHP_EXTENSIONS=ctype,iconv,pdo_sqlite \
-        ./build-static.sh
+    RUN EMBED=dist/app/ ./build-static.sh
     ```
 
+    > [!CAUTION]
+    >
+    > Some `.dockerignore` files (e.g. default [Symfony Docker `.dockerignore`](https://github.com/dunglas/symfony-docker/blob/main/.dockerignore))
+    > will ignore the `vendor/` directory and `.env` files. Be sure to adjust or remove the `.dockerignore` file before the build.
+
 2. Build:
 
     ```console
     docker build -t static-app -f static-build.Dockerfile .
     ```
 
-3. Extract the binary
+3. Extract the binary:
 
     ```console
     docker cp $(docker create --name static-app-tmp static-app):/go/src/app/dist/frankenphp-linux-x86_64 my-app ; docker rm static-app-tmp
@@ -80,9 +91,7 @@ If you don't want to use Docker, or want to build a macOS binary, use the shell
 ```console
 git clone https://github.com/dunglas/frankenphp
 cd frankenphp
-EMBED=/path/to/your/app \
-    PHP_EXTENSIONS=ctype,iconv,pdo_sqlite \
-    ./build-static.sh
+EMBED=/path/to/your/app ./build-static.sh
 ```
 
 The resulting binary is the file named `frankenphp-<os>-<arch>` in the `dist/` directory.
@@ -103,7 +112,7 @@ If your app contains a [worker script](worker.md), start the worker with somethi
 ./my-app php-server --worker public/index.php
 ```
 
-To enable HTTPS (a Let's Encrypt certificate is automatically created), HTTP/2 and HTTP/3, specify the domain name to use:
+To enable HTTPS (a Let's Encrypt certificate is automatically created), HTTP/2, and HTTP/3, specify the domain name to use:
 
 ```console
 ./my-app php-server --domain localhost
@@ -115,13 +124,20 @@ You can also run the PHP CLI scripts embedded in your binary:
 ./my-app php-cli bin/console
 ```
 
+## PHP Extensions
+
+By default, the script will build extensions required by the `composer.json` file of your project, if any.
+If the `composer.json` file doesn't exist, the default extensions are built, as documented in [the static builds entry](static.md).
+
+To customize the extensions, use the `PHP_EXTENSIONS` environment variable.
+
 ## Customizing The Build
 
 [Read the static build documentation](static.md) to see how to customize the binary (extensions, PHP version...).
 
 ## Distributing The Binary
 
-The created binary isn't compressed.
-To reduce the size of the file before sending it, you can compress it.
+On Linux, the created binary is compressed using [UPX](https://upx.github.io).
 
+On Mac, to reduce the size of the file before sending it, you can compress it.
 We recommend `xz`.

docs/fr/CONTRIBUTING.md

@@ -0,0 +1,176 @@
+# Contribuer
+
+## Compiler PHP
+
+### Avec Docker (Linux)
+
+Construisez l'image Docker de développement :
+
+```console
+docker build -t frankenphp-dev -f dev.Dockerfile .
+docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -p 8080:8080 -p 443:443 -p 443:443/udp -v $PWD:/go/src/app -it frankenphp-dev
+```
+
+L'image contient les outils de développement habituels (Go, GDB, Valgrind, Neovim...).
+
+Si la version de Docker est inférieure à 23.0, la construction échoue à cause d'un [problème de pattern](https://github.com/moby/moby/pull/42676) dans `.dockerignore`. Ajoutez les répertoires à `.dockerignore`.
+
+```patch
+ !testdata/*.php
+ !testdata/*.txt
++!caddy
++!internal
+```
+
+### Sans Docker (Linux et macOS)
+
+[Suivez les instructions pour compiler à partir des sources](compile.md) et passez l'indicateur de configuration `--debug`.
+
+## Exécution de la suite de tests
+
+```console
+go test -race -v ./...
+```
+
+## Module Caddy
+
+Construire Caddy avec le module FrankenPHP :
+
+```console
+cd caddy/frankenphp/
+go build
+cd ../../
+```
+
+Exécuter Caddy avec le module FrankenPHP :
+
+```console
+cd testdata/
+../caddy/frankenphp/frankenphp run
+```
+
+Le serveur est configuré pour écouter à l'adresse `127.0.0.1:8080`:
+
+```console
+curl -vk https://localhost/phpinfo.php
+```
+
+## Serveur de test minimal
+
+Construire le serveur de test minimal :
+
+```console
+cd internal/testserver/
+go build
+cd ../../
+```
+
+Lancer le test serveur :
+
+```console
+cd testdata/
+../internal/testserver/testserver
+```
+
+Le serveur est configuré pour écouter à l'adresse `127.0.0.1:8080`:
+
+```console
+curl -v http://127.0.0.1:8080/phpinfo.php
+```
+
+## Construire localement les images Docker
+
+Afficher le plan de compilation :
+
+```console
+docker buildx bake -f docker-bake.hcl --print
+```
+
+Construire localement les images FrankenPHP pour amd64 :
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --load --set "*.platform=linux/amd64"
+```
+
+Construire localement les images FrankenPHP pour arm64 :
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --load --set "*.platform=linux/arm64"
+```
+
+Construire à partir de zéro les images FrankenPHP pour arm64 & amd64 et les pousser sur Docker Hub :
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --no-cache --push
+```
+
+## Déboguer les erreurs de segmentation dans GitHub Actions
+
+1. Ouvrir `.github/workflows/tests.yml`
+2. Activer les symboles de débogage de la bibliothèque PHP
+
+    ```patch
+        - uses: shivammathur/setup-php@v2
+          # ...
+          env:
+            phpts: ts
+    +       debug: true
+    ```
+
+3. Activer `tmate` pour se connecter au conteneur
+
+    ```patch
+        -
+          name: Set CGO flags
+          run: echo "CGO_CFLAGS=$(php-config --includes)" >> "$GITHUB_ENV"
+    +   -
+    +     run: |
+    +       sudo apt install gdb
+    +       mkdir -p /home/runner/.config/gdb/
+    +       printf "set auto-load safe-path /\nhandle SIG34 nostop noprint pass" > /home/runner/.config/gdb/gdbinit
+    +   -
+    +     uses: mxschmitt/action-tmate@v3
+    ```
+
+4. Se connecter au conteneur
+5. Ouvrir `frankenphp.go`
+6. Activer `cgosymbolizer`
+
+    ```patch
+    - //_ "github.com/ianlancetaylor/cgosymbolizer"
+    + _ "github.com/ianlancetaylor/cgosymbolizer"
+    ```
+
+7. Télécharger le module : `go get`
+8. Dans le conteneur, vous pouvez utiliser GDB et similaires :
+
+    ```console
+    go test -c -ldflags=-w
+    gdb --args ./frankenphp.test -test.run ^MyTest$
+    ```
+
+9. Quand le bug est corrigé, annulez tous les changements
+
+## Ressources Diverses pour le Développement
+
+* [Intégration de PHP dans uWSGI](https://github.com/unbit/uwsgi/blob/master/plugins/php/php_plugin.c)
+* [Intégration de PHP dans NGINX Unit](https://github.com/nginx/unit/blob/master/src/nxt_php_sapi.c)
+* [Intégration de PHP dans Go (go-php)](https://github.com/deuill/go-php)
+* [Intégration de PHP dans Go (GoEmPHP)](https://github.com/mikespook/goemphp)
+* [Intégration de PHP dans C++](https://gist.github.com/paresy/3cbd4c6a469511ac7479aa0e7c42fea7)
+* [Extending and Embedding PHP par Sara Golemon](https://books.google.fr/books?id=zMbGvK17_tYC&pg=PA254&lpg=PA254#v=onepage&q&f=false)
+* [Qu'est-ce que TSRMLS_CC, au juste ?](http://blog.golemon.com/2006/06/what-heck-is-tsrmlscc-anyway.html)
+* [Intégration de PHP sur Mac](https://gist.github.com/jonnywang/61427ffc0e8dde74fff40f479d147db4)
+* [Bindings SDL](https://pkg.go.dev/github.com/veandco/go-sdl2@v0.4.21/sdl#Main)
+
+## Ressources Liées à Docker
+
+* [Définition du fichier Bake](https://docs.docker.com/build/customize/bake/file-definition/)
+* [docker buildx build](https://docs.docker.com/engine/reference/commandline/buildx_build/)
+
+## Commande utile
+
+```console
+apk add strace util-linux gdb
+strace -e 'trace=!futex,epoll_ctl,epoll_pwait,tgkill,rt_sigreturn' -p 1
+```

docs/fr/README.md

@@ -0,0 +1,78 @@
+# FrankenPHP : le serveur d'applications PHP moderne, écrit en Go
+
+<h1 align="center"><a href="https://frankenphp.dev"><img src="../../frankenphp.png" alt="FrankenPHP" width="600"></a></h1>
+
+FrankenPHP est un serveur d'applications moderne pour PHP construit à partir du serveur web [Caddy](https://caddyserver.com/).
+
+FrankenPHP donne des super-pouvoirs à vos applications PHP grâce à ses fonctionnalités à la pointe : [*Early Hints*](early-hints.md), [mode worker](worker.md), [fonctionnalités en temps réel](mercure.md), HTTPS automatique, prise en charge de HTTP/2 et HTTP/3...
+
+FrankenPHP fonctionne avec n'importe quelle application PHP et rend vos projets Laravel et Symfony plus rapides que jamais grâce à leurs intégrations officielles avec le mode worker.
+
+FrankenPHP peut également être utilisé comme une bibliothèque Go autonome qui permet d'intégrer PHP dans n'importe quelle application en utilisant `net/http`.
+
+Découvrez plus de détails sur ce serveur d’application dans le replay de cette conférence donnée au Forum PHP 2022 :
+
+<a href="https://dunglas.dev/2022/10/frankenphp-the-modern-php-app-server-written-in-go/"><img src="https://dunglas.dev/wp-content/uploads/2022/10/frankenphp.png" alt="Diapositives" width="600"></a>
+
+## Pour Commencer
+
+### Docker
+
+```console
+docker run -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+Rendez-vous sur `https://localhost`, c'est parti !
+
+> [!TIP]
+>
+> Ne tentez pas d'utiliser `https://127.0.0.1`. Utilisez `https://localhost` et acceptez le certificat auto-signé.
+> Utilisez [la variable d'environnement `SERVER_NAME`](config.md#environment-variables) pour changer le domaine à utiliser.
+
+### Binaire autonome
+
+Si vous préférez ne pas utiliser Docker, nous fournissons des binaires autonomes de FrankenPHP pour Linux et macOS
+contenant [PHP 8.3](https://www.php.net/releases/8.3/fr.php) et la plupart des extensions PHP populaires : [Télécharger FrankenPHP](https://github.com/dunglas/frankenphp/releases)
+
+Pour servir le contenu du répertoire courant, exécutez :
+
+```console
+./frankenphp php-server
+```
+
+Vous pouvez également exécuter des scripts en ligne de commande avec :
+
+```console
+./frankenphp php-cli /path/to/your/script.php
+```
+
+## Documentation
+
+* [Le mode worker](worker.md)
+* [Le support des Early Hints (code de statut HTTP 103)](early-hints.md)
+* [Temps réel](mercure.md)
+* [Configuration](config.md)
+* [Images Docker](docker.md)
+* [Déploiement en production](production.md)
+* [Optimisation des performances](performance.md)
+* [Créer des applications PHP **standalone**, auto-exécutables](embed.md)
+* [Créer un build statique](static.md)
+* [Compiler depuis les sources](compile.md)
+* [Intégration Laravel](laravel.md)
+* [Problèmes connus](known-issues.md)
+* [Application de démo (Symfony) et benchmarks](https://github.com/dunglas/frankenphp-demo)
+* [Documentation de la bibliothèque Go](https://pkg.go.dev/github.com/dunglas/frankenphp)
+* [Contribuer et débugger](CONTRIBUTING.md)
+
+## Exemples et squelettes
+
+* [Symfony](https://github.com/dunglas/symfony-docker)
+* [API Platform](https://api-platform.com/docs/distribution/)
+* [Laravel](laravel.md)
+* [Sulu](https://sulu.io/blog/running-sulu-with-frankenphp)
+* [WordPress](https://github.com/StephenMiracle/frankenwp)
+* [Drupal](https://github.com/dunglas/frankenphp-drupal)
+* [Joomla](https://github.com/alexandreelise/frankenphp-joomla)
+* [TYPO3](https://github.com/ochorocho/franken-typo3)

docs/fr/compile.md

@@ -0,0 +1,98 @@
+# Compiler depuis les sources
+
+Ce document explique comment créer un build FrankenPHP qui chargera PHP en tant que bibliothèque dynamique.
+C'est la méthode recommandée.
+
+Alternativement, il est aussi possible de [créer des builds statiques](static.md).
+
+## Installer PHP
+
+FrankenPHP est compatible avec PHP 8.2 et versions ultérieures.
+
+Tout d'abord, [téléchargez les sources de PHP](https://www.php.net/downloads.php) et extrayez-les :
+
+```console
+tar xf php-*
+cd php-*/
+```
+
+Ensuite, configurez PHP pour votre système d'exploitation.
+
+Les options de configuration suivantes sont nécessaires pour la compilation, mais vous pouvez également inclure d'autres options selon vos besoins, par exemple pour ajouter des extensions et fonctionnalités supplémentaires.
+
+### Linux
+
+```console
+./configure \
+    --enable-embed \
+    --enable-zts \
+    --disable-zend-signals \
+    --enable-zend-max-execution-timers
+```
+
+### Mac
+
+Utilisez le gestionnaire de paquets [Homebrew](https://brew.sh/) pour installer `libiconv`, `bison`, `re2c` et `pkg-config` :
+
+```console
+brew install libiconv bison re2c pkg-config
+echo 'export PATH="/opt/homebrew/opt/bison/bin:$PATH"' >> ~/.zshrc
+```
+
+Puis exécutez le script de configuration :
+
+```console
+./configure \
+    --enable-embed=static \
+    --enable-zts \
+    --disable-zend-signals \
+    --disable-opcache-jit \
+    --enable-static \
+    --enable-shared=no \
+    --with-iconv=/opt/homebrew/opt/libiconv/
+```
+
+## Compilez PHP
+
+Finalement, compilez et installez PHP :
+
+```console
+make -j"$(getconf _NPROCESSORS_ONLN)"
+sudo make install
+```
+
+## Compiler l'application Go
+
+Vous pouvez maintenant compilez FrankenPHP :
+
+```console
+curl -L https://github.com/dunglas/frankenphp/archive/refs/heads/main.tar.gz | tar xz
+cd frankenphp-main/caddy/frankenphp
+CGO_CFLAGS=$(php-config --includes) CGO_LDFLAGS="$(php-config --ldflags) $(php-config --libs)" go build
+```
+
+### Utiliser xcaddy
+
+Alternativement, Vous pouvez utiliser [xcaddy](https://github.com/caddyserver/xcaddy) pour compiler FrankenPHP avec [des modules Caddy additionnels](https://caddyserver.com/docs/modules/):
+
+```console
+CGO_ENABLED=1 \
+XCADDY_GO_BUILD_FLAGS="-ldflags '-w -s'" \
+xcaddy build \
+    --output frankenphp \
+    --with github.com/dunglas/frankenphp/caddy \
+    --with github.com/dunglas/caddy-cbrotli \
+    --with github.com/dunglas/mercure/caddy \
+    --with github.com/dunglas/vulcain/caddy
+    # Add extra Caddy modules here
+```
+
+> [!TIP]
+>
+> Si vous utilisez musl libc (la bibliothèque par défaut sur Alpine Linux) et Symfony,
+> vous pourriez avoir besoin d'augmenter la taille par défaut de la pile.
+> Sinon, vous pourriez rencontrer des erreurs telles que `PHP Fatal error: Maximum call stack size of 83360 bytes reached during compilation. Try splitting expression`
+>
+> Pour ce faire, modifiez la variable d'environnement `XCADDY_GO_BUILD_FLAGS` en quelque chose comme
+> `XCADDY_GO_BUILD_FLAGS=$'-ldflags "-w -s -extldflags \'-Wl,-z,stack-size=0x80000\'"'`
+> (modifiez la valeur de la taille de la pile selon les besoins de votre application).

docs/fr/config.md

@@ -0,0 +1,159 @@
+# Configuration
+
+FrankenPHP, Caddy ainsi que les modules Mercure et Vulcain peuvent être configurés en utilisant [les formats pris en charge par Caddy](https://caddyserver.com/docs/getting-started#your-first-config).
+
+Dans l'image Docker, le chemin du `Caddyfile` est `/etc/caddy/Caddyfile`.
+
+Vous pouvez également configurer PHP en utilisant `php.ini` comme d'habitude.
+
+Dans l'image Docker, le fichier `php.ini` n'est pas présent, vous pouvez le créer manuellement ou copier un template officiel :
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# Développement :
+RUN cp $PHP_INI_DIR/php.ini-development $PHP_INI_DIR/php.ini
+
+# Ou production :
+RUN cp $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
+```
+
+Le binaire statique cherchera un fichier `php.ini` dans le répertoire de travail courant,
+dans `/lib/` ainsi que [les autres emplacements standards](https://www.php.net/manual/fr/configuration.file.php).
+
+## Configuration du Caddyfile
+
+Pour enregistrer l'exécutable de FrankenPHP, l'[option globale](https://caddyserver.com/docs/caddyfile/concepts#global-options) `frankenphp` doit être définie, puis les [directives HTTP](https://caddyserver.com/docs/caddyfile/concepts#directives) `php_server` ou `php` peuvent être utilisées dans les blocs de site pour servir votre application PHP.
+
+Exemple minimal :
+
+```caddyfile
+{
+ # Activer FrankenPHP
+ frankenphp
+}
+
+localhost {
+ # Activer la compression (optionnel)
+ encode zstd br gzip
+ # Exécuter les fichiers PHP dans le répertoire courant et servir les assets
+ php_server
+}
+```
+
+En option, le nombre de threads à créer et les [workers](worker.md) à démarrer avec le serveur peuvent être spécifiés sous l'option globale.
+
+```caddyfile
+{
+ frankenphp {
+  num_threads <num_threads> # Définit le nombre de threads PHP à démarrer. Par défaut : 2x le nombre de CPUs disponibles.
+  worker {
+   file <path> # Définit le chemin vers le script worker.
+   num <num> # Définit le nombre de threads PHP à démarrer, par défaut 2x le nombre de CPUs disponibles.
+   env <key> <value> # Définit une variable d'environnement supplémentaire avec la valeur donnée. Peut être spécifié plusieurs fois pour régler plusieurs variables d'environnement.
+  }
+ }
+}
+
+# ...
+```
+
+Vous pouvez également utiliser la forme courte de l'option worker en une seule ligne :
+
+```caddyfile
+{
+ frankenphp {
+  worker <file> <num>
+ }
+}
+
+# ...
+```
+
+Vous pouvez aussi définir plusieurs workers si vous servez plusieurs applications sur le même serveur :
+
+```caddyfile
+{
+ frankenphp {
+  worker /path/to/app/public/index.php <num>
+  worker /path/to/other/public/index.php <num>
+ }
+}
+
+app.example.com {
+ root * /path/to/app/public
+ php_server
+}
+
+other.example.com {
+ root * /path/to/other/public
+ php_server
+}
+
+# ...
+```
+
+L'utilisation de la directive `php_server` est généralement suffisante,
+mais si vous avez besoin d'un contrôle total, vous pouvez utiliser la directive `php`, qui permet un plus grand niveau de finesse dans la configuration.
+
+Utiliser la directive `php_server` est équivalent à cette configuration :
+
+```caddyfile
+route {
+ # Ajoute un slash final pour les requêtes de répertoire
+ @canonicalPath {
+  file {path}/index.php
+  not path */
+ }
+ redir @canonicalPath {path}/ 308
+ # Si le fichier demandé n'existe pas, essayer les fichiers index
+ @indexFiles file {
+  try_files {path} {path}/index.php index.php
+  split_path .php
+ }
+ rewrite @indexFiles {http.matchers.file.relative}
+ # FrankenPHP!
+ @phpFiles path *.php
+ php @phpFiles
+ file_server
+}
+```
+
+Les directives `php_server` et `php` disposent des options suivantes :
+
+```caddyfile
+php_server [<matcher>] {
+ root <directory> # Définit le dossier racine du le site. Par défaut : valeur de la directive `root` parente.
+ split_path <delim...> # Définit les sous-chaînes pour diviser l'URI en deux parties. La première sous-chaîne correspondante sera utilisée pour séparer le "path info" du chemin. La première partie est suffixée avec la sous-chaîne correspondante et sera considérée comme le nom réel de la ressource (script CGI). La seconde partie sera définie comme PATH_INFO pour utilisation par le script. Par défaut : `.php`
+ resolve_root_symlink false # Désactive la résolution du répertoire `root` vers sa valeur réelle en évaluant un lien symbolique, s'il existe (activé par défaut).
+ env <key> <value> # Définit une variable d'environnement supplémentaire avec la valeur donnée. Peut être spécifié plusieurs fois pour plusieurs variables d'environnement.
+}
+```
+
+## Variables d'environnement
+
+Les variables d'environnement suivantes peuvent être utilisées pour insérer des directives Caddy dans le `Caddyfile` sans le modifier :
+
+* `SERVER_NAME` : change [les adresses sur lesquelles écouter](https://caddyserver.com/docs/caddyfile/concepts#addresses), les noms d'hôte fournis seront également utilisés pour le certificat TLS généré
+* `CADDY_GLOBAL_OPTIONS` : injecte [des options globales](https://caddyserver.com/docs/caddyfile/options)
+* `FRANKENPHP_CONFIG` : insère la configuration sous la directive `frankenphp`
+
+Comme pour les SAPI FPM et CLI, les variables d'environnement ne sont exposées par défaut dans la superglobale `$_SERVER`.
+
+La valeur `S` de [la directive `variables_order` de PHP](https://www.php.net/manual/fr/ini.core.php#ini.variables-order) est toujours équivalente à `ES`, que `E` soit défini ailleurs dans cette directive ou non.
+
+## Configuration PHP
+
+Pour charger [des fichiers de configuration PHP supplémentaires](https://www.php.net/manual/fr/configuration.file.php#configuration.file.scan), la variable d'environnement `PHP_INI_SCAN_DIR` peut être utilisée.
+Lorsqu'elle est définie, PHP chargera tous les fichiers avec l'extension `.ini` présents dans les répertoires donnés.
+
+## Activer le mode debug
+
+Lors de l'utilisation de l'image Docker, définissez la variable d'environnement `CADDY_GLOBAL_OPTIONS` sur `debug` pour activer le mode debug :
+
+```console
+docker run -v $PWD:/app/public \
+    -e CADDY_GLOBAL_OPTIONS=debug \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```

docs/fr/docker.md

@@ -0,0 +1,192 @@
+# Création d'une image Docker personnalisée
+
+Les images Docker de [FrankenPHP](https://hub.docker.com/r/dunglas/frankenphp) sont basées sur les [images PHP officielles](https://hub.docker.com/_/php/). Des variantes Debian et Alpine Linux sont fournies pour les architectures populaires. Les variantes Debian sont recommandées.
+
+Des variantes pour PHP 8.2 et PHP 8.3 sont disponibles. [Parcourir les tags](https://hub.docker.com/r/dunglas/frankenphp/tags).
+
+## Comment utiliser les images
+
+Créez un `Dockerfile` dans votre projet :
+
+```dockerfile
+FROM dunglas/frankenphp
+
+COPY . /app/public
+```
+
+Ensuite, exécutez ces commandes pour construire et exécuter l'image Docker :
+
+```console
+docker build -t my-php-app .
+docker run -it --rm --name my-running-app my-php-app
+```
+
+## Comment installer plus d'extensions PHP
+
+Le script [`docker-php-extension-installer`](https://github.com/mlocati/docker-php-extension-installer) est fourni dans l'image de base.
+Il est facile d'ajouter des extensions PHP supplémentaires :
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# ajoutez des extensions supplémentaires ici :
+RUN install-php-extensions \
+ pdo_mysql \
+ gd \
+ intl \
+ zip \
+ opcache
+```
+
+## Comment installer plus de modules Caddy
+
+FrankenPHP est construit sur Caddy, et tous les [modules Caddy](https://caddyserver.com/docs/modules/) peuvent être utilisés avec FrankenPHP.
+
+La manière la plus simple d'installer des modules Caddy personnalisés est d'utiliser [xcaddy](https://github.com/caddyserver/xcaddy):
+
+```dockerfile
+FROM dunglas/frankenphp:latest-builder AS builder
+
+# Copier xcaddy dans l'image du constructeur
+COPY --from=caddy:builder /usr/bin/xcaddy /usr/bin/xcaddy
+
+# CGO doit être activé pour construire FrankenPHP
+ENV CGO_ENABLED=1 XCADDY_SETCAP=1 XCADDY_GO_BUILD_FLAGS="-ldflags '-w -s'"
+RUN xcaddy build \
+	--output /usr/local/bin/frankenphp \
+	--with github.com/dunglas/frankenphp=./ \
+	--with github.com/dunglas/frankenphp/caddy=./caddy/ \
+  --with github.com/dunglas/caddy-cbrotli \
+	# Mercure et Vulcain sont inclus dans la construction officielle, mais n'hésitez pas à les retirer
+	--with github.com/dunglas/mercure/caddy \
+	--with github.com/dunglas/vulcain/caddy
+	# Ajoutez des modules Caddy supplémentaires ici
+
+FROM dunglas/frankenphp AS runner
+
+# Remplacer le binaire officiel par celui contenant vos modules personnalisés
+COPY --from=builder /usr/local/bin/frankenphp /usr/local/bin/frankenphp
+```
+
+L'image builder fournie par FrankenPHP contient une version compilée de `libphp`.
+[Les images builder](https://hub.docker.com/r/dunglas/frankenphp/tags?name=builder) sont fournies pour toutes les versions de FrankenPHP et PHP, à la fois pour Debian et Alpine.
+
+> [!TIP]
+>
+> Si vous utilisez Alpine Linux et Symfony,
+> vous devrez peut-être [augmenter la taille de pile par défaut](compile.md#using-xcaddy).
+
+## Activer le mode Worker par défaut
+
+Définissez la variable d'environnement `FRANKENPHP_CONFIG` pour démarrer FrankenPHP avec un script worker :
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# ...
+
+ENV FRANKENPHP_CONFIG="worker ./public/index.php"
+```
+
+## Utiliser un volume en développement
+
+Pour développer facilement avec FrankenPHP, montez le répertoire de l'hôte contenant le code source de l'application comme un volume dans le conteneur Docker :
+
+```console
+docker run -v $PWD:/app/public -p 80:80 -p 443:443 -p 443:443/udp --tty my-php-app
+```
+
+> ![TIP]
+>
+> L'option --tty permet d'avoir des logs lisibles par un humain au lieu de logs JSON.
+
+Avec Docker Compose :
+
+```yaml
+# compose.yaml
+
+services:
+  php:
+    image: dunglas/frankenphp
+    # décommentez la ligne suivante si vous souhaitez utiliser un Dockerfile personnalisé
+    #build: .
+    # décommentez la ligne suivante si vous souhaitez exécuter ceci dans un environnement de production
+    # restart: always
+    ports:
+      - "80:80" # HTTP
+      - "443:443" # HTTPS
+      - "443:443/udp" # HTTP/3
+    volumes:
+      - ./:/app/public
+      - caddy_data:/data
+      - caddy_config:/config
+    # commentez la ligne suivante en production, elle permet d'avoir de beaux logs lisibles en dev
+    tty: true
+
+# Volumes nécessaires pour les certificats et la configuration de Caddy
+volumes:
+  caddy_data:
+  caddy_config:
+```
+
+## Exécution en tant qu'utilisateur non-root
+
+FrankenPHP peut s'exécuter en tant qu'utilisateur non-root dans Docker.
+
+Voici un exemple de `Dockerfile` le permettant :
+
+```dockerfile
+FROM dunglas/frankenphp
+
+ARG USER=www-data
+
+RUN \
+ # Utilisez "adduser -D ${USER}" pour les distributions basées sur Alpine
+ useradd -D ${USER}; \
+ # Ajouter la capacité supplémentaire de se lier aux ports 80 et 443
+ setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/frankenphp; \
+ # Donner l'accès en écriture à /data/caddy et /config/caddy
+ chown -R ${USER}:${USER} /data/caddy && chown -R ${USER}:${USER} /config/caddy
+
+USER ${USER}
+```
+
+### Exécution sans capacité
+
+Même lorsqu'il s'exécute en tant qu'utilisateur autre que root, FrankenPHP a besoin de la capacité `CAP_NET_BIND_SERVICE`
+pour que son serveur utilise les ports privilégiés (80 et 443).
+
+Si vous exposez FrankenPHP sur un port non privilégié (à partir de 1024), il est possible de faire fonctionner le serveur web avec un utilisateur qui n'est pas root, et sans avoir besoin d'aucune capacité.
+
+```dockerfile
+FROM dunglas/frankenphp
+
+ARG USER=www-data
+
+RUN
+	# Utiliser "adduser -D ${USER}" pour les distros basées sur Alpine
+	useradd -D ${USER};
+	# Supprimer la capacité par défaut
+	setcap -r /usr/local/bin/frankenphp; \
+	# Donner un accès en écriture à /data/caddy et /config/caddy
+	chown -R ${USER}:${USER} /data/caddy && chown -R ${USER}:${USER} /config/caddy
+
+USER ${USER}
+```
+
+Ensuite, définissez la variable d'environnement `SERVER_NAME` pour utiliser un port non privilégié.
+Exemple `:8000`
+
+## Mises à jour
+
+Les images Docker sont construites :
+
+* lorsqu'une nouvelle version est taguée
+* tous les jours à 4h UTC, si de nouvelles versions des images officielles PHP sont disponibles
+
+## Versions de développement
+
+Les versions de développement sont disponibles dans le dépôt Docker [`dunglas/frankenphp-dev`](https://hub.docker.com/repository/docker/dunglas/frankenphp-dev). Un nouveau build est déclenché chaque fois qu'un commit est poussé sur la branche principale du dépôt GitHub.
+
+Les tags `latest*` pointent vers la tête de la branche `main`.
+Les tags sous la forme `sha-<hash-du-commit-git>` sont également disponibles.

docs/fr/early-hints.md

@@ -0,0 +1,21 @@
+# Early Hints
+
+FrankenPHP prend nativement en charge le code de statut [103 Early Hints](https://developer.chrome.com/blog/early-hints/).
+L'utilisation des Early Hints peut améliorer le temps de chargement de vos pages web de 30 %.
+
+```php
+<?php
+
+header('Link: </style.css>; rel=preload; as=style');
+headers_send(103);
+
+// vos algorithmes lents et requêtes SQL 🤪
+
+echo <<<'HTML'
+<!DOCTYPE html>
+<title>Hello FrankenPHP</title>
+<link rel="stylesheet" href="style.css">
+HTML;
+```
+
+Les Early Hints sont pris en charge à la fois par les modes "standard" et [worker](worker.md).

docs/fr/embed.md

@@ -0,0 +1,139 @@
+# Applications PHP en tant que binaires autonomes
+
+FrankenPHP a la capacité d'incorporer le code source et les assets des applications PHP dans un binaire statique et autonome.
+
+Grâce à cette fonctionnalité, les applications PHP peuvent être distribuées en tant que binaires autonomes qui incluent l'application elle-même, l'interpréteur PHP et Caddy, un serveur web de qualité production.
+
+Pour en savoir plus sur cette fonctionnalité, consultez [la présentation faite par Kévin à la SymfonyCon 2023](https://dunglas.dev/2023/12/php-and-symfony-apps-as-standalone-binaries/).
+
+## Préparer votre application
+
+Avant de créer le binaire autonome, assurez-vous que votre application est prête à être intégrée.
+
+Vous devrez probablement :
+
+* Installer les dépendances de production de l'application
+* Dumper l'autoloader
+* Activer le mode production de votre application (si disponible)
+* Supprimer les fichiers inutiles tels que `.git` ou les tests pour réduire la taille de votre binaire final
+
+Par exemple, pour une application Symfony, lancez les commandes suivantes :
+
+```console
+# Exporter le projet pour se débarrasser de .git/, etc.
+mkdir $TMPDIR/my-prepared-app
+git archive HEAD | tar -x -C $TMPDIR/my-prepared-app
+cd $TMPDIR/my-prepared-app
+
+# Définir les variables d'environnement appropriées
+echo APP_ENV=prod > .env.local
+echo APP_DEBUG=0 >> .env.local
+
+# Supprimer les tests
+rm -Rf tests/
+
+# Installer les dépendances
+composer install --ignore-platform-reqs --no-dev -a
+
+# Optimiser le .env
+composer dump-env prod
+```
+
+### Personnaliser la configuration
+
+Pour personnaliser [la configuration](config.md),
+vous pouvez mettre un fichier `Caddyfile` ainsi qu'un fichier `php.ini`
+dans le répertoire principal de l'application à intégrer
+(`$TMPDIR/my-prepared-app` dans l'exemple précédent).
+
+## Créer un binaire Linux
+
+La manière la plus simple de créer un binaire Linux est d'utiliser le builder basé sur Docker que nous fournissons.
+
+1. Créez un fichier nommé `static-build.Dockerfile` dans le répertoire de votre application préparée :
+
+    ```dockerfile
+    FROM --platform=linux/amd64 dunglas/frankenphp:static-builder
+
+    # Copy your app
+    WORKDIR /go/src/app/dist/app
+    COPY . .
+
+    # Build the static binary, be sure to select only the PHP extensions you want
+    WORKDIR /go/src/app/
+    RUN EMBED=dist/app/ \
+        PHP_EXTENSIONS=ctype,iconv,pdo_sqlite \
+        ./build-static.sh
+    ```
+
+    > [!CAUTION]
+    >
+    > Certains fichiers `.dockerignore` (par exemple celui fourni par défaut par [Symfony Docker](https://github.com/dunglas/symfony-docker/blob/main/.dockerignore))
+    > empêchent la copie du dossier `vendor/` et des fichiers `.env`. Assurez-vous d'ajuster ou de supprimer le fichier `.dockerignore` avant le build.
+
+2. Construisez:
+
+    ```console
+    docker build -t static-app -f static-build.Dockerfile .
+    ```
+
+3. Extrayez le binaire :
+
+    ```console
+    docker cp $(docker create --name static-app-tmp static-app):/go/src/app/dist/frankenphp-linux-x86_64 my-app ; docker rm static-app-tmp
+    ```
+
+Le binaire généré sera nommé `my-app` dans le répertoire courant.
+
+## Créer un binaire pour d'autres systèmes d'exploitation
+
+Si vous ne souhaitez pas utiliser Docker, ou souhaitez construire un binaire macOS, utilisez le script shell que nous fournissons :
+
+```console
+git clone https://github.com/dunglas/frankenphp
+cd frankenphp
+EMBED=/path/to/your/app \
+    PHP_EXTENSIONS=ctype,iconv,pdo_sqlite \
+    ./build-static.sh
+```
+
+Le binaire obtenu est le fichier nommé `frankenphp-<os>-<arch>` dans le répertoire `dist/`.
+
+## Utiliser le binaire
+
+C'est tout ! Le fichier `my-app` (ou `dist/frankenphp-<os>-<arch>` sur d'autres systèmes d'exploitation) contient votre application autonome !
+
+Pour démarrer l'application web, exécutez :
+
+```console
+./my-app php-server
+```
+
+Si votre application contient un [script worker](worker.md), démarrez le worker avec quelque chose comme :
+
+```console
+./my-app php-server --worker public/index.php
+```
+
+Pour activer HTTPS (un certificat Let's Encrypt est automatiquement créé), HTTP/2 et HTTP/3, spécifiez le nom de domaine à utiliser :
+
+```console
+./my-app php-server --domain localhost
+```
+
+Vous pouvez également exécuter les scripts CLI PHP incorporés dans votre binaire :
+
+```console
+./my-app php-cli bin/console
+```
+
+## Personnaliser la compilation
+
+[Consultez la documentation sur la compilation statique](static.md) pour voir comment personnaliser le binaire (extensions, version PHP...).
+
+## Distribuer le binaire
+
+Sous Linux, le binaire est compressé par défaut à l'aide de [UPX](https://upx.github.io).
+
+Sous Mac, pour réduire la taille du fichier avant de l'envoyer, vous pouvez le compresser.
+Nous recommandons `xz`.

docs/fr/github-actions.md

@@ -0,0 +1,31 @@
+# Utilisation de GitHub Actions
+
+Ce dépôt construit et déploie l'image Docker sur [le Hub Docker](https://hub.docker.com/r/dunglas/frankenphp) pour
+chaque pull request approuvée ou sur votre propre fork une fois configuré.
+
+## Configuration de GitHub Actions
+
+Dans les paramètres du dépôt, sous "secrets", ajoutez les secrets suivants :
+
+- `REGISTRY_LOGIN_SERVER` : Le registre Docker à utiliser (par exemple, `docker.io`).
+- `REGISTRY_USERNAME` : Le nom d'utilisateur à utiliser pour se connecter au registre (par exemple, `dunglas`).
+- `REGISTRY_PASSWORD` : Le mot de passe à utiliser pour se connecter au registre (par exemple, une clé d'accès).
+- `IMAGE_NAME` : Le nom de l'image (par exemple, `dunglas/frankenphp`).
+
+## Construction et push de l'image
+
+1. Créez une Pull Request ou poussez vers votre fork.
+2. GitHub Actions va construire l'image et exécuter tous les tests.
+3. Si la construction est réussie, l'image sera poussée vers le registre en utilisant le tag `pr-x`, où `x` est le numéro de la PR.
+
+## Déploiement de l'image
+
+1. Une fois la Pull Request fusionnée, GitHub Actions exécutera à nouveau les tests et construira une nouvelle image.
+2. Si la construction est réussie, le tag `main` sera mis à jour dans le registre Docker.
+
+## Releases
+
+1. Créez un nouveau tag dans le dépôt.
+2. GitHub Actions va construire l'image et exécuter tous les tests.
+3. Si la compilation est réussie, l'image sera poussée vers le registre en utilisant le nom du tag comme tag (par exemple, `v1.2.3` et `v1.2` seront créés).
+4. Le tag `latest` sera également mis à jour.

docs/fr/known-issues.md

@@ -0,0 +1,108 @@
+# Problèmes Connus
+
+## Fibres
+
+Appeller de fonctions et mots clefs PHP qui eux-mêmes appellent [cgo](https://go.dev/blog/cgo) dans des [Fibres](https://www.php.net/manual/fr/language.fibers.php) est connu pour provoquer des plantages.
+
+Ce problème est [en cours de correction par le projet Go](https://github.com/golang/go/issues/62130).
+
+En attendant, une solution consiste à ne pas utiliser de mots clefs (comme `echo`) et de fonctions (comme `header()`) qui délèguent à Go depuis l'intérieur de fibres.
+
+Ce code risque de planter car il utilise `echo` dans une fibre :
+
+```php
+$fiber = new Fiber(function() {
+    echo 'Dans la fibre'.PHP_EOL;
+    echo 'Toujours dedans'.PHP_EOL;
+});
+$fiber->start();
+```
+
+A la place, retournez la valeur de la Fibre et utilisez-la à l'extérieur :
+
+```php
+$fiber = new Fiber(function() {
+    Fiber::suspend('Dans la fibre'.PHP_EOL));
+    Fiber::suspend('Toujours dedans'.PHP_EOL));
+});
+echo $fiber->start();
+echo $fiber->resume();
+$fiber->resume();
+```
+
+## Extensions PHP non prises en charge
+
+Les extensions suivantes sont connues pour ne pas être compatibles avec FrankenPHP :
+
+| Nom                                                                                                       | Raison          | Alternatives                                                                                                         |
+| ---------------------------------------------------------------------------------------------------------- | --------------- | -------------------------------------------------------------------------------------------------------------------- |
+| [imap](https://www.php.net/manual/en/imap.installation.php)                                                | Non thread-safe | [javanile/php-imap2](https://github.com/javanile/php-imap2), [webklex/php-imap](https://github.com/Webklex/php-imap) |
+| [newrelic](https://docs.newrelic.com/docs/apm/agents/php-agent/getting-started/introduction-new-relic-php/)| Non thread-safe | -                                                                                                                    |
+
+## Extensions PHP boguées
+
+Les extensions suivantes ont des bugs connus ou des comportements inattendus lorsqu'elles sont utilisées avec FrankenPHP :
+
+| Nom                                                           | Problème                                                                                                                                                                                                                                                                                                                                      |
+|---------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [ext-openssl](https://www.php.net/manual/fr/book.openssl.php) | Lors de l'utilisation d'une version statique de FrankenPHP (construite avec la libc musl), l'extension OpenSSL peut planter sous de fortes charges. Une solution consiste à utiliser une version liée dynamiquement (comme celle utilisée dans les images Docker). Ce bogue est [suivi par PHP](https://github.com/php/php-src/issues/13648). |
+| [parallel](https://github.com/krakjoe/parallel)               | `parallel` fait geler et planter FrankenPHP. [Rapport de bogue](https://github.com/krakjoe/parallel/issues/308)                                                                                                                                                                                                                               |
+
+## get_browser
+
+La fonction [get_browser()](https://www.php.net/manual/fr/function.get-browser.php) semble avoir de mauvaises performances après un certain temps. Une solution est de mettre en cache (par exemple, avec [APCu](https://www.php.net/manual/en/book.apcu.php)) les résultats par agent utilisateur, car ils sont statiques.
+
+## Binaire autonome et images Docker basées sur Alpine
+
+Le binaire autonome et les images docker basées sur Alpine (`dunglas/frankenphp:*-alpine`) utilisent [musl libc](https://musl.libc.org/) au lieu de [glibc et ses amis](https://www.etalabs.net/compare_libcs.html), pour garder une taille de binaire plus petite. Cela peut entraîner des problèmes de compatibilité. En particulier, le drapeau glob `GLOB_BRACE` n'est [pas disponible](https://www.php.net/manual/fr/function.glob.php).
+
+## Utilisation de `https://127.0.0.1` avec Docker
+
+Par défaut, FrankenPHP génère un certificat TLS pour `localhost`.
+C'est l'option est la plus simple et est recommandée pour le développement local.
+
+Si vous voulez vraiment utiliser `127.0.0.1` comme hôte, il est possible de configure FrankenPHP pour générer un certificat pour cela en définissant le nom du serveur à `127.0.0.1`.
+
+Malheureusement, cela ne suffit pas lors de l'utilisation de Docker à cause de [son système de gestion des réseaux](https://docs.docker.com/network/).
+Vous obtiendrez une erreur TLS similaire à `curl: (35) LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error`.
+
+Si vous utilisez Linux, une solution est d'utiliser [le pilote de réseau "hôte"](https://docs.docker.com/network/network-tutorial-host/) :
+
+```console
+docker run \
+    -e SERVER_NAME="127.0.0.1" \
+    -v $PWD:/app/public \
+    --network host \
+    dunglas/frankenphp
+```
+
+Le pilote de réseau "hôte" n'est pas pris en charge sur Mac et Windows. Sur ces plateformes, vous devrez deviner l'adresse IP du conteneur et l'inclure dans les noms de serveur.
+
+Exécutez la commande `docker network inspect bridge` et inpectez la clef `Containers` pour identifier la dernière adresse IP attribuée sous la clef `IPv4Address`, puis incrémentez-la de un. Si aucun conteneur n'est en cours d'exécution, la première adresse IP attribuée est généralement `172.17.0.2`.
+
+Ensuite, incluez ceci dans la variable d'environnement `SERVER_NAME` :
+
+```console
+docker run \
+    -e SERVER_NAME="127.0.0.1, 172.17.0.3" \
+    -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+> ![CAUTION]
+>
+> Assurez-vous de remplacer `172.17.0.3` par l'IP qui sera attribuée à votre conteneur.
+
+Vous devriez maintenant pouvoir accéder à `https://127.0.0.1` depuis la machine hôte.
+
+Si ce n'est pas le cas, lancez FrankenPHP en mode debug pour essayer de comprendre le problème :
+
+```console
+docker run \
+    -e CADDY_GLOBAL_OPTIONS="debug" \
+    -e SERVER_NAME="127.0.0.1" \
+    -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```

docs/fr/laravel.md

@@ -0,0 +1,75 @@
+# Laravel
+
+## Docker
+
+Déployer une application web [Laravel](https://laravel.com) avec FrankenPHP est très facile.
+Il suffit de monter le projet dans le répertoire `/app` de l'image Docker officielle.
+
+Exécutez cette commande depuis le répertoire principal de votre application Laravel :
+
+```console
+docker run -p 80:80 -p 443:443 -p 443:443/udp -v $PWD:/app dunglas/frankenphp
+```
+
+Et profitez !
+
+## Installation Locale
+
+Vous pouvez également exécuter vos projets Laravel avec FrankenPHP depuis votre machine locale :
+
+1. [Téléchargez le binaire correspondant à votre système](https://github.com/dunglas/frankenphp/releases)
+2. Ajoutez la configuration suivante dans un fichier nommé `Caddyfile` placé dans le répertoire racine de votre projet Laravel :
+
+ 	```caddyfile
+    {
+     frankenphp
+    }
+
+    # Le nom de domaine de votre serveur
+    localhost {
+     # Définir le répertoire racine sur le dossier public/
+     root * public/
+     # Autoriser la compression (optionnel)
+     encode zstd br gzip
+     # Exécuter les scripts PHP du dossier public/ et servir les assets
+     php_server
+    }
+    ```
+
+3. Démarrez FrankenPHP depuis le répertoire racine de votre projet Laravel : `./frankenphp run`
+
+## Laravel Octane
+
+Octane peut être installé via le gestionnaire de paquets Composer :
+
+```console
+composer require laravel/octane
+```
+
+Après avoir installé Octane, vous pouvez exécuter la commande Artisan `octane:install`, qui installera le fichier de configuration d'Octane dans votre application :
+
+```console
+php artisan octane:install --server=frankenphp
+```
+
+Le serveur Octane peut être démarré via la commande Artisan `octane:frankenphp`.
+
+```console
+php artisan octane:frankenphp
+```
+
+La commande `octane:frankenphp` peut prendre les options suivantes :
+
+* `--host` : L'adresse IP à laquelle le serveur doit se lier (par défaut : `127.0.0.1`)
+* `--port` : Le port sur lequel le serveur doit être disponible (par défaut : `8000`)
+* `--admin-port` : Le port sur lequel le serveur administratif doit être disponible (par défaut : `2019`)
+* `--workers` : Le nombre de workers qui doivent être disponibles pour traiter les requêtes (par défaut : `auto`)
+* `--max-requests` : Le nombre de requêtes à traiter avant de recharger le serveur (par défaut : `500`)
+* `--caddyfile` : Le chemin vers le fichier `Caddyfile` de FrankenPHP
+* `--https` : Activer HTTPS, HTTP/2, et HTTP/3, et générer automatiquement et renouveler les certificats
+* `--http-redirect` : Activer la redirection HTTP vers HTTPS (uniquement activé si --https est passé)
+* `--watch` : Recharger automatiquement le serveur lorsque l'application est modifiée
+* `--poll` : Utiliser le sondage du système de fichiers pendant la surveillance pour surveiller les fichiers sur un réseau
+* `--log-level` : Enregistrer les messages au niveau de journalisation spécifié ou au-dessus
+
+En savoir plus sur Laravel Octane [dans sa documentation officielle](https://laravel.com/docs/octane).

docs/fr/mercure.md

@@ -0,0 +1,12 @@
+# Temps Réel
+
+FrankenPHP est livré avec un hub [Mercure](https://mercure.rocks) intégré.
+Mercure permet de pousser des événements en temps réel vers tous les appareils connectés : ils recevront un événement JavaScript instantanément.
+
+Aucune bibliothèque JS ou SDK requis !
+
+![Mercure](../mercure-hub.png)
+
+Pour activer le hub Mercure, mettez à jour le `Caddyfile` comme décrit [sur le site de Mercure](https://mercure.rocks/docs/hub/config).
+
+Pour pousser des mises à jour Mercure depuis votre code, nous recommandons le [Composant Mercure de Symfony](https://symfony.com/components/Mercure) (vous n'avez pas besoin du framework full stack Symfony pour l'utiliser).

docs/fr/performance.md

@@ -0,0 +1,110 @@
+# Performance
+
+Par défaut, FrankenPHP essaie d'offrir un bon compromis entre performance et facilité d'utilisation.
+Cependant, il est possible d'améliorer considérablement les performances en utilisant une configuration appropriée.
+
+## Nombre de threads et de workers
+
+Par défaut, FrankenPHP démarre 2 fois plus de threads et de workers (en mode worker) que le nombre de CPU disponibles.
+
+Les valeurs appropriées dépendent fortement de la manière dont votre application est écrite, de ce qu'elle fait et de votre matériel.
+Nous recommandons fortement de modifier ces valeurs.
+
+Pour trouver les bonnes valeurs, il est souhaitable d'effectuer des tests de charge simulant le trafic réel.
+[k6](https://k6.io) et [Gatling](https://gatling.io) sont de bons outils pour cela.
+
+Pour configurer le nombre de threads, utilisez l'option `num_threads` des directives `php_server` et `php`.
+Pour changer le nombre de travailleurs, utilisez l'option `num` de la section `worker` de la directive `frankenphp`.
+
+## Mode worker
+
+Activer [le mode worker](worker.md) améliorere considérablement les performances,
+mais votre application doit être adaptée pour être compatible avec ce mode :
+vous devez créer un script worker et vous assurer que l'application n'a pas de fuite de mémoire.
+
+## Ne pas utiliser musl
+
+Les binaires statiques que nous fournissons et la variante Alpine Linux des images Docker officielles
+utilisent [la librairie musl](https://musl.libc.org).
+
+PHP est connu pour être significativement plus lent lorsqu'il utilise cette bibliothèque C alternative au lieu de la bibliothèque GNU traditionnelle,
+surtout lorsqu'il est compilé en mode ZTS (thread-safe), ce qui est nécessaire pour FrankenPHP.
+
+En outre, certains bogues ne se produisent que lors de l'utilisation de musl.
+
+Dans les environnements de production, nous recommandons fortement d'utiliser la glibc.
+
+Ceci peut être réalisé en utilisant les images Docker Debian (par défaut) et [en compilant FrankenPHP à partir des sources](compile.md).
+
+Alternativement, nous fournissons des binaires statiques compilés avec [l'allocateur mimalloc](https://github.com/microsoft/mimalloc), ce qui rend FrankenPHP+musl plus rapide (mais toujours plus lent que FrankenPHP+glibc).
+
+## Configuration du runtime Go
+
+FrankenPHP est écrit en Go.
+
+En général, le runtime Go ne nécessite pas de configuration particulière, mais dans certaines circonstances,
+une configuration spécifique améliore les performances.
+
+Vous voudrez probablement mettre la variable d'environnement `GODEBUG` à `cgocheck=0` (la valeur par défaut dans les images Docker de FrankenPHP).
+
+Si vous exécutez FrankenPHP dans des conteneurs (Docker, Kubernetes, LXC...) et que vous limitez la mémoire disponible pour les conteneurs,
+mettez la variable d'environnement `GOMEMLIMIT` à la quantité de mémoire disponible.
+
+Pour plus de détails, [la page de documentation Go dédiée à ce sujet](https://pkg.go.dev/runtime#hdr-Environment_Variables) est à lire absolument pour tirer le meilleur parti du runtime.
+
+## `file_server`
+
+Par défaut, la directive `php_server` met automatiquement en place un serveur de fichiers pour
+pour servir les fichiers statiques (assets) stockés dans le répertoire racine.
+
+Cette fonctionnalité est pratique, mais a un coût.
+Pour la désactiver, utilisez la configuration suivante :
+
+```caddyfile
+php_server {
+    file_server off
+}
+```
+
+## *Placeholders*
+
+Vous pouvez utiliser des [*placeholders*](https://caddyserver.com/docs/conventions#placeholders) dans les directives `root` et `env`.
+Cependant, cela empêche la mise en cache de ces valeurs et a un coût important en termes de performances.
+
+Si possible, évitez les *placeholders* dans ces directives.
+
+## `resolve_root_symlink`
+
+Par défaut, si le *document root* est un lien symbolique, il est automatiquement résolu par FrankenPHP (c'est nécessaire pour le bon fonctionnement de PHP).
+Si la racine du document n'est pas un lien symbolique, vous pouvez désactiver cette fonctionnalité.
+
+```caddyfile
+php_server {
+    resolve_root_symlink false
+}
+```
+
+Cela améliorera les performances si la directive `root` contient des [*placeholders*](https://caddyserver.com/docs/conventions#placeholders).
+Le gain sera négligeable dans les autres cas.
+
+## Journaux
+
+La journalisation est évidemment très utile, mais, par définition, elle nécessite des opérations d'*I/O* et des allocations de mémoire,
+ce qui réduit considérablement les performances.
+Assurez-vous de [définir le niveau de journalisation](https://caddyserver.com/docs/caddyfile/options#log) correctement,
+et de ne journaliser que ce qui est nécessaire.
+
+## Performances de PHP
+
+FrankenPHP utilise l'interpréteur PHP officiel.
+Toutes les optimisations de performances habituelles liées à PHP s'appliquent à FrankenPHP.
+
+En particulier :
+
+* vérifiez que [OPcache](https://www.php.net/manual/en/book.opcache.php) est installé, activé et correctement configuré
+* activez [les optimisations de l'autoloader de Composer](https://getcomposer.org/doc/articles/autoloader-optimization.md)
+* assurez-vous que le cache `realpath` est suffisamment grand pour les besoins de votre application
+* utilisez le [pré-chargement](https://www.php.net/manual/en/opcache.preloading.php)
+
+Pour plus de détails, lisez [l'entrée de la documentation dédiée de Symfony](https://symfony.com/doc/current/performance.html)
+(la plupart des conseils sont utiles même si vous n'utilisez pas Symfony).

docs/fr/production.md

@@ -0,0 +1,139 @@
+# Déploiement en Production
+
+Dans ce tutoriel, nous apprendrons comment déployer une application PHP sur un serveur unique en utilisant Docker Compose.
+
+Si vous utilisez Symfony, lisez plutôt la page de documentation "[Déployer en production](https://github.com/dunglas/symfony-docker/blob/main/docs/production.md)" du projet Symfony Docker (qui utilise FrankenPHP).
+
+Si vous utilisez API Platform (qui utilise également FrankenPHP), référez-vous à [la documentation de déploiement du framework](https://api-platform.com/docs/deployment/).
+
+## Préparer votre application
+
+Tout d'abord, créez un `Dockerfile` dans le répertoire racine de votre projet PHP :
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# Assurez-vous de remplacer "your-domain-name.example.com" par votre nom de domaine
+ENV SERVER_NAME=your-domain-name.example.com
+# Si vous souhaitez désactiver HTTPS, utilisez cette valeur à la place :
+#ENV SERVER_NAME=:80
+
+# Activer les paramètres de production de PHP
+RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
+
+# Copiez les fichiers PHP de votre projet dans le répertoire public
+COPY . /app/public
+# Si vous utilisez Symfony ou Laravel, vous devez copier l'intégralité du projet à la place :
+#COPY . /app
+```
+
+Consultez "[Construire une image Docker personnalisée](docker.md)" pour plus de détails et d'options,
+et pour apprendre à personnaliser la configuration, installer des extensions PHP et des modules Caddy.
+
+Si votre projet utilise Composer, assurez-vous de l'inclure dans l'image Docker et d'installer vos dépendances.
+
+Ensuite, ajoutez un fichier `compose.yaml` :
+
+```yaml
+services:
+  php:
+    image: dunglas/frankenphp
+    restart: always
+    ports:
+      - "80:80" # HTTP
+      - "443:443" # HTTPS
+      - "443:443/udp" # HTTP/3
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+
+# Volumes nécessaires pour les certificats et la configuration de Caddy
+volumes:
+  caddy_data:
+  caddy_config:
+```
+
+> [!NOTE]
+>
+> Les exemples précédents sont destinés à une utilisation en production.
+> En développement, vous pourriez vouloir utiliser un volume, une configuration PHP différente et une valeur différente pour la variable d'environnement `SERVER_NAME`.
+>
+> Jetez un œil au projet [Symfony Docker](https://github.com/dunglas/symfony-docker)
+> (qui utilise FrankenPHP) pour un exemple plus avancé utilisant des images multi-étapes,
+> Composer, des extensions PHP supplémentaires, etc.
+
+Pour finir, si vous utilisez Git, commitez ces fichiers et poussez-les.
+
+## Préparer un serveur
+
+Pour déployer votre application en production, vous avez besoin d'un serveur.
+Dans ce tutoriel, nous utiliserons une machine virtuelle fournie par DigitalOcean, mais n'importe quel serveur Linux peut fonctionner.
+Si vous avez déjà un serveur Linux avec Docker installé, vous pouvez passer directement à [la section suivante](#configurer-un-nom-de-domaine).
+
+Sinon, utilisez [ce lien affilié](https://m.do.co/c/5d8aabe3ab80) pour obtenir 200$ de crédit gratuit, créez un compte, puis cliquez sur "Créer un Droplet".
+Ensuite, cliquez sur l'onglet "Marketplace" sous la section "Choisir une image" et recherchez l'application nommée "Docker".
+Cela provisionnera un serveur Ubuntu avec les dernières versions de Docker et Docker Compose déjà installées !
+
+Pour des fins de test, les plans les moins chers seront suffisants.
+Pour une utilisation en production réelle, vous voudrez probablement choisir un plan dans la section "General Usage" pour répondre à vos besoins.
+
+![Déployer FrankenPHP sur DigitalOcean avec Docker](../digitalocean-droplet.png)
+
+Vous pouvez conserver les paramètres par défaut pour les autres paramètres, ou les ajuster selon vos besoins.
+N'oubliez pas d'ajouter votre clé SSH ou de créer un mot de passe puis appuyez sur le bouton "Finalize and create".
+
+Ensuite, attendez quelques secondes pendant que votre Droplet est en cours de provisionnement.
+Lorsque votre Droplet est prêt, utilisez SSH pour vous connecter :
+
+```console
+ssh root@<droplet-ip>
+```
+
+## Configurer un nom de domaine
+
+Dans la plupart des cas, vous souhaiterez associer un nom de domaine à votre site.
+Si vous ne possédez pas encore de nom de domaine, vous devrez en acheter un via un registraire.
+
+Ensuite, créez un enregistrement DNS de type `A` pour votre nom de domaine pointant vers l'adresse IP de votre serveur :
+
+```dns
+your-domain-name.example.com.  IN  A     207.154.233.113
+```
+
+Exemple avec le service DigitalOcean Domains ("Networking" > "Domains") :
+
+![Configurer les DNS sur DigitalOcean](../digitalocean-dns.png)
+
+> [!NOTE]
+>
+> Let's Encrypt, le service utilisé par défaut par FrankenPHP pour générer automatiquement un certificat TLS, ne prend pas en charge l'utilisation d'adresses IP nues. L'utilisation d'un nom de domaine est obligatoire pour utiliser Let's Encrypt.
+
+## Déploiement
+
+Copiez votre projet sur le serveur en utilisant `git clone`, `scp`, ou tout autre outil qui pourrait répondre à votre besoin.
+Si vous utilisez GitHub, vous voudrez peut-être utiliser [une clef de déploiement](https://docs.github.com/en/free-pro-team@latest/developers/overview/managing-deploy-keys#deploy-keys).
+Les clés de déploiement sont également [prises en charge par GitLab](https://docs.gitlab.com/ee/user/project/deploy_keys/).
+
+Exemple avec Git :
+
+```console
+git clone git@github.com:<username>/<project-name>.git
+```
+
+Accédez au répertoire contenant votre projet (`<project-name>`), et démarrez l'application en mode production :
+
+```console
+docker compose up -d --wait
+```
+
+Votre serveur est opérationnel, et un certificat HTTPS a été automatiquement généré pour vous.
+Rendez-vous sur `https://your-domain-name.example.com` !
+
+> [!CAUTION]
+>
+> Docker peut avoir une couche de cache, assurez-vous d'avoir la bonne version de build pour chaque déploiement ou reconstruisez votre projet avec l'option `--no-cache` pour éviter les problèmes de cache.
+
+## Déploiement sur Plusieurs Nœuds
+
+Si vous souhaitez déployer votre application sur un cluster de machines, vous pouvez utiliser [Docker Swarm](https://docs.docker.com/engine/swarm/stack-deploy/), qui est compatible avec les fichiers Compose fournis.
+Pour un déploiement sur Kubernetes, jetez un œil au [Helm chart fourni avec API Platform](https://api-platform.com/docs/deployment/kubernetes/), qui utilise FrankenPHP.

docs/fr/static.md

@@ -0,0 +1,81 @@
+# Créer un binaire statique
+
+Au lieu d'utiliser une installation locale de la bibliothèque PHP, il est possible de créer un build statique de FrankenPHP grâce à l'excellent projet [static-php-cli](https://github.com/crazywhalecc/static-php-cli) (malgré son nom, ce projet prend en charge tous les SAPIs, pas seulement CLI).
+
+Avec cette méthode, un binaire portable unique contiendra l'interpréteur PHP, le serveur web Caddy et FrankenPHP !
+
+FrankenPHP permet également [d'embarquer l'application PHP dans le binaire statique](embed.md).
+
+## Linux
+
+Nous fournissons une image Docker pour créer un binaire statique pour Linux :
+
+```console
+docker buildx bake --load static-builder
+docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/dist/frankenphp-linux-$(uname -m) frankenphp ; docker rm static-builder
+```
+
+Le binaire statique résultant est nommé `frankenphp`, et il est disponible dans le répertoire courant.
+
+Si vous souhaitez construire le binaire statique sans Docker, regardez les instructions pour macOS, qui fonctionnent également pour Linux.
+
+### Extensions personnalisées
+
+Par défaut, la plupart des extensions PHP populaires sont compilées.
+
+Pour réduire la taille du binaire et diminuer la surface d'attaque, vous pouvez choisir la liste des extensions à construire en utilisant l'argument Docker `PHP_EXTENSIONS`.
+
+Par exemple, exécutez la commande suivante pour ne construire que l'extension `opcache` :
+
+```console
+docker buildx bake --load --set static-builder.args.PHP_EXTENSIONS=opcache,pdo_sqlite static-builder
+# ...
+```
+
+Pour ajouter des bibliothèques permettant des fonctionnalités supplémentaires aux extensions que vous avez activées, vous pouvez utiliser l'argument Docker `PHP_EXTENSION_LIBS` :
+
+```console
+docker buildx bake \
+  --load \
+  --set static-builder.args.PHP_EXTENSIONS=gd \
+  --set static-builder.args.PHP_EXTENSION_LIBS=libjpeg,libwebp \
+  static-builder
+```
+
+Voir aussi comment [personnaliser la construction](#personnalisation-de-la-construction)
+
+### Jeton GitHub
+
+Si vous atteignez la limite de taux d'appels de l'API GitHub, définissez un jeton d'accès personnel GitHub dans une variable d'environnement nommée `GITHUB_TOKEN` :
+
+```console
+GITHUB_TOKEN="xxx" docker --load buildx bake static-builder
+# ...
+```
+
+## macOS
+
+Exécutez le script suivant pour créer un binaire statique pour macOS (vous devez avoir [Homebrew](https://brew.sh/) d'installé) :
+
+```console
+git clone https://github.com/dunglas/frankenphp
+cd frankenphp
+./build-static.sh
+```
+
+Note : ce script fonctionne également sur Linux (et probablement sur d'autres Unix) et est utilisé en interne par le builder statique basé sur Docker que nous fournissons.
+
+## Personnalisation de la construction
+
+Les variables d'environnement suivantes peuvent être transmises à `docker build` et au script `build-static.sh` pour personnaliser la construction statique :
+
+* `FRANKENPHP_VERSION` : la version de FrankenPHP à utiliser
+* `PHP_VERSION` : la version de PHP à utiliser
+* `PHP_EXTENSIONS` : les extensions PHP à construire ([liste des extensions prises en charge](https://static-php.dev/en/guide/extensions.html))
+* `PHP_EXTENSION_LIBS` : bibliothèques supplémentaires à construire qui ajoutent des fonctionnalités aux extensions
+* `EMBED` : chemin de l'application PHP à intégrer dans le binaire
+* `CLEAN` : lorsque défini, `libphp` et toutes ses dépendances sont construites à partir de zéro (pas de cache)
+* `DEBUG_SYMBOLS` : lorsque défini, les symboles de débogage ne seront pas supprimés et seront ajoutés dans le binaire
+* `NO_COMPRESS`: ne pas compresser le binaire avec UPX
+* `MIMALLOC`: (expérimental, Linux seulement) remplace l'allocateur mallocng de musl par [mimalloc](https://github.com/microsoft/mimalloc) pour des performances améliorées
+* `RELEASE` : (uniquement pour les mainteneurs) lorsque défini, le binaire résultant sera uploadé sur GitHub

docs/fr/worker.md

@@ -0,0 +1,142 @@
+# Utilisation des workers FrankenPHP
+
+Démarrez votre application une fois et gardez-la en mémoire.
+FrankenPHP traitera les requêtes entrantes en quelques millisecondes.
+
+## Démarrage des scripts workers
+
+### Docker
+
+Définissez la valeur de la variable d'environnement `FRANKENPHP_CONFIG` à `worker /path/to/your/worker/script.php` :
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker /app/path/to/your/worker/script.php" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+### Binaire autonome
+
+Utilisez l'option --worker de la commande php-server pour servir le contenu du répertoire courant en utilisant un worker :
+
+```console
+./frankenphp php-server --worker /path/to/your/worker/script.php
+```
+
+Si votre application PHP est [intégrée dans le binaire](embed.md), vous pouvez également ajouter un `Caddyfile` personnalisé dans le répertoire racine de l'application.
+Il sera utilisé automatiquement.
+
+## Runtime Symfony
+
+Le mode worker de FrankenPHP est pris en charge par le [Composant Runtime de Symfony](https://symfony.com/doc/current/components/runtime.html).
+Pour démarrer une application Symfony dans un worker, installez le package FrankenPHP de [PHP Runtime](https://github.com/php-runtime/runtime) :
+
+```console
+composer require runtime/frankenphp-symfony
+```
+
+Démarrez votre serveur d'application en définissant la variable d'environnement `APP_RUNTIME` pour utiliser le Runtime Symfony de FrankenPHP :
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php" \
+    -e APP_RUNTIME=Runtime\\FrankenPhpSymfony\\Runtime \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+## Laravel Octane
+
+Voir [la documentation dédiée](laravel.md#laravel-octane).
+
+## Applications Personnalisées
+
+L'exemple suivant montre comment créer votre propre script worker sans dépendre d'une bibliothèque tierce :
+
+```php
+<?php
+// public/index.php
+
+// Empêcher la terminaison du script worker lorsqu'une connexion client est interrompue
+ignore_user_abort(true);
+
+// Démarrer votre application
+require __DIR__.'/vendor/autoload.php';
+
+$myApp = new \App\Kernel();
+$myApp->boot();
+
+// En dehors de la boucle pour de meilleures performances (moins de travail effectué)
+$handler = static function () use ($myApp) {
+    // Appelé lorsqu'une requête est reçue,
+    // les superglobales, php://input, etc., sont réinitialisés
+    echo $myApp->handle($_GET, $_POST, $_COOKIE, $_FILES, $_SERVER);
+};
+
+for ($nbRequests = 0, $running = true; isset($_SERVER['MAX_REQUESTS']) && ($nbRequests < ((int)$_SERVER['MAX_REQUESTS'])) && $running; ++$nbRequests) {
+    $running = \frankenphp_handle_request($handler);
+
+    // Faire quelque chose après l'envoi de la réponse HTTP
+    $myApp->terminate();
+
+    // Exécuter le ramasse-miettes pour réduire les chances qu'il soit déclenché au milieu de la génération d'une page
+    gc_collect_cycles();
+}
+
+// Nettoyage
+$myApp->shutdown();
+```
+
+Ensuite, démarrez votre application et utilisez la variable d'environnement `FRANKENPHP_CONFIG` pour configurer votre worker :
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+Par défaut, 2 workers par CPU sont démarrés.
+Vous pouvez également configurer le nombre de workers à démarrer :
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php 42" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+### Redémarrer le worker après un certain nombre de requêtes
+
+Comme PHP n'a pas été initialement conçu pour des processus de longue durée, de nombreuses bibliothèques et codes anciens présentent encore des fuites de mémoire.
+Une solution pour utiliser ce type de code en mode worker est de redémarrer le script worker après avoir traité un certain nombre de requêtes :
+
+Le code du worker précédent permet de configurer un nombre maximal de requêtes à traiter en définissant une variable d'environnement nommée `MAX_REQUESTS`.
+
+## Comportement des superglobales
+
+[Les superglobales PHP](https://www.php.net/manual/fr/language.variables.superglobals.php) (`$_SERVER`, `$_ENV`, `$_GET`...)
+se comportent comme suit :
+
+* avant le premier appel à `frankenphp_handle_request()`, les superglobales contiennent des valeurs liées au script worker lui-même
+* pendant et après l'appel à `frankenphp_handle_request()`, les superglobales contiennent des valeurs générées à partir de la requête HTTP traitée, chaque appel à `frankenphp_handle_request()` change les valeurs des superglobales
+
+Pour accéder aux superglobales du script worker à l'intérieur de la fonction de rappel, vous devez les copier et importer la copie dans le scope de la fonction :
+
+```php
+<?php
+// Copier la superglobale $_SERVER du worker avant le premier appel à frankenphp_handle_request()
+$workerServer = $_SERVER;
+
+$handler = static function () use ($workerServer) {
+    var_dump($_SERVER); // $_SERVER lié à la requête
+    var_dump($workerServer); // $_SERVER du script worker
+};
+
+// ...
+```

docs/github-actions.md

@@ -8,19 +8,19 @@ every approved pull request or on your own fork once setup.
 In the repository settings, under secrets, add the following secrets:
 
 - `REGISTRY_LOGIN_SERVER`: The docker registry to use (e.g. `docker.io`).
-- `REGISTRY_USERNAME`: The username to use to login to the registry (e.g. `dunglas`).
-- `REGISTRY_PASSWORD`: The password to use to login to the registry (e.g. an access key).
+- `REGISTRY_USERNAME`: The username to use to log in to the registry (e.g. `dunglas`).
+- `REGISTRY_PASSWORD`: The password to use to log in to the registry (e.g. an access key).
 - `IMAGE_NAME`: The name of the image (e.g. `dunglas/frankenphp`).
 
-## Building and pushing the image
+## Building and Pushing the Image
 
-1. Create a pull request or push to your fork.
+1. Create a Pull Request or push to your fork.
 2. GitHub Actions will build the image and run any tests.
 3. If the build is successful, the image will be pushed to the registry using the `pr-x`, where `x` is the PR number, as the tag.
 
-## Deploying the image
+## Deploying the Image
 
-1. Once the pull request is merged, GitHub Actions will again run the tests and build a new image.
+1. Once the Pull Request is merged, GitHub Actions will again run the tests and build a new image.
 2. If the build is successful, the `main` tag will be updated in the Docker registry.
 
 ## Releases

docs/known-issues.md

@@ -34,13 +34,23 @@ $fiber->resume();
 
 The following extensions are known not to be compatible with FrankenPHP:
 
-| Name                                                        | Reason          | Alternatives                                                                                                         |
-| ----------------------------------------------------------- | --------------- | -------------------------------------------------------------------------------------------------------------------- |
-| [imap](https://www.php.net/manual/en/imap.installation.php) | Not thread-safe | [javanile/php-imap2](https://github.com/javanile/php-imap2), [webklex/php-imap](https://github.com/Webklex/php-imap) |
+| Name                                                                                                        | Reason          | Alternatives                                                                                                         |
+|-------------------------------------------------------------------------------------------------------------|-----------------|----------------------------------------------------------------------------------------------------------------------|
+| [imap](https://www.php.net/manual/en/imap.installation.php)                                                 | Not thread-safe | [javanile/php-imap2](https://github.com/javanile/php-imap2), [webklex/php-imap](https://github.com/Webklex/php-imap) |
+| [newrelic](https://docs.newrelic.com/docs/apm/agents/php-agent/getting-started/introduction-new-relic-php/) | Not thread-safe | -                                                                                                                    |
+
+## Buggy PHP Extensions
+
+The following extensions have known bugs and unexpected behaviors when used with FrankenPHP:
+
+| Name                                                          | Problem                                                                                                                                                                                                                                                                                         |
+|---------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [ext-openssl](https://www.php.net/manual/en/book.openssl.php) | When using a static build of FrankenPHP (built with the musl libc), the OpenSSL extension may crash under heavy loads. A workaround is to use a dynamically linked build (like the one used in Docker images). This bug is [being tracked by PHP](https://github.com/php/php-src/issues/13648). |
+| [parallel](https://github.com/krakjoe/parallel)               | `parallel` makes FrankenPHP freeze and crash. [Bug report](https://github.com/krakjoe/parallel/issues/308)                                                                                                                                                                                      |
 
 ## get_browser
 
-The [get_browser()](https://www.php.net/manual/en/function.get-browser.php) function seems to perform badly after a while. A workaround is to cache (e.g. with APCU) the results per User Agent, as they are static.
+The [get_browser()](https://www.php.net/manual/en/function.get-browser.php) function seems to perform badly after a while. A workaround is to cache (e.g. with [APCu](https://www.php.net/manual/en/book.apcu.php)) the results per User Agent, as they are static.
 
 ## Standalone Binary and Alpine-based Docker Images
 
@@ -80,7 +90,7 @@ docker run \
     dunglas/frankenphp
 ```
 
-> ![CAUTION]
+> [!CAUTION]
 >
 > Be sure to replace `172.17.0.3` with the IP that will be assigned to your container.
 
@@ -90,9 +100,74 @@ If that's not the case, start FrankenPHP in debug mode to try to figure out the
 
 ```console
 docker run \
-    -e CADDY_GLOBAL_OPTIONS="debug"
+    -e CADDY_GLOBAL_OPTIONS="debug" \
     -e SERVER_NAME="127.0.0.1" \
     -v $PWD:/app/public \
     -p 80:80 -p 443:443 -p 443:443/udp \
     dunglas/frankenphp
 ```
+
+## Composer Scripts Referencing `@php`
+
+[Composer scripts](https://getcomposer.org/doc/articles/scripts.md) may want to execute a PHP binary for some tasks, e.g. in [a Laravel project](laravel.md) to run `@php artisan package:discover --ansi`. This [currently fails](https://github.com/dunglas/frankenphp/issues/483#issuecomment-1899890915) for two reasons:
+
+* Composer does not know how to call the FrankenPHP binary;
+* Composer may add PHP settings using the `-d` flag in the command, which FrankenPHP does not yet support.
+
+As a workaround, we can create a shell script in `/usr/local/bin/php` which strips the unsupported parameters and then calls FrankenPHP:
+
+```bash
+#!/usr/bin/env bash
+args=("$@")
+index=0
+for i in "$@"
+do
+    if [ "$i" == "-d" ]; then
+        unset 'args[$index]'
+        unset 'args[$index+1]'
+    fi
+    index=$((index+1))
+done
+
+/usr/local/bin/frankenphp php-cli ${args[@]}
+```
+
+Then set the environment variable `PHP_BINARY` to the path of our `php` script and run Composer:
+
+```console
+export PHP_BINARY=/usr/local/bin/php
+composer install
+```
+
+## Troubleshooting TLS/SSL Issues with Static Binaries
+
+When using the static binaries, you may encounter the following TLS-related errors, for instance when sending emails using STARTTLS:
+
+```text
+Unable to connect with STARTTLS: stream_socket_enable_crypto(): SSL operation failed with code 5. OpenSSL Error messages:
+error:80000002:system library::No such file or directory
+error:80000002:system library::No such file or directory
+error:80000002:system library::No such file or directory
+error:0A000086:SSL routines::certificate verify failed
+```
+
+As the static binary doesn't bundle TLS certificates, you need to point OpenSSL to your local CA certificates installation.
+
+Inspect the output of [`openssl_get_cert_locations()`](https://www.php.net/manual/en/function.openssl-get-cert-locations.php),
+to find where CA certificates must be installed and store them at this location.
+
+> ![WARNING]
+> Web and CLI contexts may have different settings.
+> Be sure to run `openssl_get_cert_locations()` in the proper context.
+
+[CA certificates extracted from Mozilla can be downloaded on the curl site](https://curl.se/docs/caextract.html).
+
+Alternatively, many distributions, including Debian, Ubuntu, and Alpine provide packages named `ca-certificates` that contain these certificates.
+
+It's also possible to use the `SSL_CERT_FILE` and `SSL_CERT_DIR` to hint OpenSSL where to look for CA certificates:
+
+```console
+# Set TLS certificates environment variables
+export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+export SSL_CERT_DIR=/etc/ssl/certs
+```

docs/laravel.md

@@ -22,20 +22,16 @@ Alternatively, you can run your Laravel projects with FrankenPHP from your local
     ```caddyfile
     {
     	frankenphp
-    	order php_server before file_server
     }
 
     # The domain name of your server
     localhost {
-    	# Set the webroot to the public/ dir
+    	# Set the webroot to the public/ directory
     	root * public/
     	# Enable compression (optional)
     	encode zstd br gzip
-    	# Execute PHP files in the current directory and serve assets
-    	php_server {
-    		# Required for the public/storage/ dir
-    		resolve_root_symlink
-    	}
+    	# Execute PHP files from the public/ directory and serve assets
+    	php_server
     }
     ```
 
@@ -55,13 +51,13 @@ After installing Octane, you may execute the `octane:install` Artisan command, w
 php artisan octane:install --server=frankenphp
 ```
 
-The Octane server can be started via the `octane:start` Artisan command.
+The Octane server can be started via the `octane:frankenphp` Artisan command.
 
 ```console
-php artisan octane:start
+php artisan octane:frankenphp
 ```
 
-The `octane:start` command can take the following options:
+The `octane:frankenphp` command can take the following options:
 
 * `--host`: The IP address the server should bind to (default: `127.0.0.1`)
 * `--port`: The port the server should be available on (default: `8000`)
@@ -70,9 +66,114 @@ The `octane:start` command can take the following options:
 * `--max-requests`: The number of requests to process before reloading the server (default: `500`)
 * `--caddyfile`: The path to the FrankenPHP `Caddyfile` file
 * `--https`: Enable HTTPS, HTTP/2, and HTTP/3, and automatically generate and renew certificates
-* --http-redirect : Enable HTTP to HTTPS redirection (only enabled if --https is passed)
+* `--http-redirect`: Enable HTTP to HTTPS redirection (only enabled if --https is passed)
 * `--watch`: Automatically reload the server when the application is modified
 * `--poll`: Use file system polling while watching in order to watch files over a network
 * `--log-level`: Log messages at or above the specified log level
 
 Learn more about [Laravel Octane in its official documentation](https://laravel.com/docs/octane).
+
+## Laravel Apps As Standalone Binaries
+
+Using [FrankenPHP's application embedding feature](embed.md), it's possible to distribute Laravel
+apps as standalone binaries.
+
+Follow these steps to package your Laravel app as a standalone binary for Linux:
+
+1. Create a file named `static-build.Dockerfile` in the repository of your app:
+
+    ```dockerfile
+    FROM --platform=linux/amd64 dunglas/frankenphp:static-builder
+
+    # Copy your app
+    WORKDIR /go/src/app/dist/app
+    COPY . .
+
+    # Remove the tests and other unneeded files to save space
+    # Alternatively, add these files to a .dockerignore file
+    RUN rm -Rf tests/
+
+    # Copy .env file
+    RUN cp .env.example .env
+    # Change APP_ENV and APP_DEBUG to be production ready
+    RUN sed -i'' -e 's/^APP_ENV=.*/APP_ENV=production/' -e 's/^APP_DEBUG=.*/APP_DEBUG=false/' .env
+
+    # Make other changes to your .env file if needed
+
+    # Install the dependencies
+    RUN composer install --ignore-platform-reqs --no-dev -a
+
+    # Build the static binary
+    WORKDIR /go/src/app/
+    RUN EMBED=dist/app/ ./build-static.sh
+    ```
+
+    > [!CAUTION]
+    >
+    > Some `.dockerignore` files
+    > will ignore the `vendor/` directory and `.env` files. Be sure to adjust or remove the `.dockerignore` file before the build.
+
+2. Build:
+
+    ```console
+    docker build -t static-laravel-app -f static-build.Dockerfile .
+    ```
+
+3. Extract the binary:
+
+    ```console
+    docker cp $(docker create --name static-laravel-app-tmp static-laravel-app):/go/src/app/dist/frankenphp-linux-x86_64 frankenphp ; docker rm static-laravel-app-tmp
+    ```
+
+4. Populate caches:
+
+    ```console
+    ./frankenphp php-cli artisan optimize
+    ```
+
+5. Run database migrations (if any):
+
+    ```console
+    ./frankenphp php-cli artisan migrate
+    ````
+
+6. Generate app's secret key:
+
+    ```console
+    ./frankenphp php-cli artisan key:generate
+    ```
+
+7. Start the server:
+
+    ```console
+    ./frankenphp php-server
+    ```
+
+Your app is now ready!
+
+Learn more about the options available and how to build binaries for other OSes in the [applications embedding](embed.md)
+documentation.
+
+### Changing The Storage Path
+
+By default, Laravel stores uploaded files, caches, logs, etc. in the application's `storage/` directory.
+This is not suitable for embedded applications, as each new version will be extracted into a different temporary directory.
+
+Set the `LARAVEL_STORAGE_PATH` environment variable (for example, in your `.env` file) or call the `Illuminate\Foundation\Application::useStoragePath()` method to use a directory outside the temporary directory.
+
+### Running Octane With Standalone Binaries
+
+It's even possible to package Laravel Octane apps as standalone binaries!
+
+To do so, [install Octane properly](#laravel-octane) and follow the steps described in [the previous section](#laravel-apps-as-standalone-binaries).
+
+Then, to start FrankenPHP in worker mode through Octane, run:
+
+```console
+PATH="$PWD:$PATH" ./frankenphp php-cli artisan octane:frankenphp
+```
+
+> ![CAUTION]
+>
+> For the command to work, the standalone binary **must** be named `frankenphp`
+> because Octane needs a program named `frankenphp` available in the path.

docs/mercure.md

@@ -1,11 +1,11 @@
 # Real-time
 
-FrankenPHP comes with a built-in Mercure hub!
+FrankenPHP comes with a built-in [Mercure](https://mercure.rocks) hub!
 Mercure allows to push events in real-time to all the connected devices: they will receive a JavaScript event instantly.
 
 No JS library or SDK required!
 
-![Mercure](https://mercure.rocks/static/main.png)
+![Mercure](mercure-hub.png)
 
 To enable the Mercure hub, update the `Caddyfile` as described [on Mercure's site](https://mercure.rocks/docs/hub/config).
 

docs/performance.md

@@ -0,0 +1,110 @@
+# Performance
+
+By default, FrankenPHP tries to offer a good compromise between performance and ease of use.
+However, it is possible to substantially improve performance using an appropriate configuration.
+
+## Number of Threads and Workers
+
+By default, FrankenPHP starts 2 times more threads and workers (in worker mode) than the available numbers of CPU.
+
+The appropriate values depend heavily on how your application is written, what it does and your hardware.
+We strongly recommend changing these values.
+
+To find the right values, it's best to run load tests simulating real traffic.
+[k6](https://k6.io) and [Gatling](https://gatling.io) are good tools for this.
+
+To configure the number of threads, use the `num_threads` option of the `php_server` and `php` directives.
+To change the number of workers, use the `num` option of the `worker` section of the `frankenphp` directive.
+
+## Worker Mode
+
+Enabling [the worker mode](worker.md) dramatically improves performance,
+but your app must be adapted to be compatible with this mode:
+you need to create a worker script and to be sure that the app is not leaking memory.
+
+## Don't Use musl
+
+The static binaries we provide and the Alpine Linux variant of the official Docker images
+are using [the musl libc](https://musl.libc.org).
+
+PHP is known to be significantly slower when using this alternative C library instead of the traditional GNU library,
+especially when compiled in ZTS mode (thread-safe), which is required for FrankenPHP.
+
+Also, some bugs also only happen when using musl.
+
+In production environements, we strongly recommend to use the glibc.
+
+This can be achieved by using the Debian Docker images (the default) and [by compiling FrankenPHP from sources](compile.md).
+
+Alternatively, we provide static binaries compiled with [the mimalloc allocator](https://github.com/microsoft/mimalloc), which makes FrankenPHP+musl faster (but still slower than FrankenPHP+glibc).
+
+## Go Runtime Configuration
+
+FrankenPHP is written in Go.
+
+In general, the Go runtime doesn't require any special configuration, but in certain circumstances,
+specific configuration improves performance.
+
+You likely want to set the `GODEBUG` environment variable to `cgocheck=0` (the default in the FrankenPHP Docker images).
+
+If you run FrankenPHP in containers (Docker, Kubernetes, LXC...) and limit the memory available for the containers,
+set the `GOMEMLIMIT` environment variable to the available amount of memory.
+
+For more details, [the Go documentation page dedicated to this subject](https://pkg.go.dev/runtime#hdr-Environment_Variables) is a must-read to get the most out of the runtime.
+
+## `file_server`
+
+By default, the `php_server` directive automatically sets up a file server to
+serve static files (assets) stored in the root directory.
+
+This feature is convenient, but comes with a cost.
+To disable it, use the following config:
+
+```caddyfile
+php_server {
+    file_server off
+}
+```
+
+## Placeholders
+
+You can use [placeholders](https://caddyserver.com/docs/conventions#placeholders) in the `root` and `env` directives.
+However, this prevents caching these values, and comes with a significant performance cost.
+
+If possible, avoid placeholders in these directives.
+
+## `resolve_root_symlink`
+
+By default, if the document root is a symbolic link, it is automatically resolved by FrankenPHP (this is necessary for PHP to work properly).
+If the document root is not a symlink, you can disable this feature.
+
+```caddyfile
+php_server {
+    resolve_root_symlink false
+}
+```
+
+This will improve performance if the `root` directive contains [placeholders](https://caddyserver.com/docs/conventions#placeholders).
+The gain will be negligible in other cases.
+
+## Logs
+
+Logging is obviously very useful, but, by definition,
+it requires I/O operations and memory allocations, which considerably reduces performance.
+Make sure you [set the logging level](https://caddyserver.com/docs/caddyfile/options#log) correctly,
+and only log what's necessary.
+
+## PHP Performance
+
+FrankenPHP uses the official PHP interpreter.
+All usual PHP-related performance optimizations apply with FrankenPHP.
+
+In particular:
+
+* check that [OPcache](https://www.php.net/manual/en/book.opcache.php) is installed, enabled and properly configured
+* enable [Composer autoloader optimizations](https://getcomposer.org/doc/articles/autoloader-optimization.md)
+* ensure that the `realpath` cache is big enough for the needs of your application
+* use [preloading](https://www.php.net/manual/en/opcache.preloading.php)
+
+For more details, read [the dedicated Symfony documentation entry](https://symfony.com/doc/current/performance.html)
+(most tips are useful even if you don't use Symfony).

docs/production.md

@@ -54,7 +54,8 @@ volumes:
   caddy_config:
 ```
 
-> [!NOTE]  
+> [!NOTE]
+>
 > The previous examples are intended for production usage.
 > In development, you may want to use a volume, a different PHP configuration and a different value for the `SERVER_NAME` environment variable.
 >
@@ -104,7 +105,8 @@ Example with the DigitalOcean Domains service ("Networking" > "Domains"):
 
 ![Configuring DNS on DigitalOcean](digitalocean-dns.png)
 
-> [!NOTE]  
+> [!NOTE]
+>
 > Let's Encrypt, the service used by default by FrankenPHP to automatically generate a TLS certificate doesn't support using bare IP addresses. Using a domain name is mandatory to use Let's Encrypt.
 
 ## Deploying
@@ -125,14 +127,15 @@ Go into the directory containing your project (`<project-name>`), and start the
 docker compose up -d --wait
 ```
 
-Your server is up and running, and a HTTPS certificate has been automatically generated for you.
+Your server is up and running, and an HTTPS certificate has been automatically generated for you.
 Go to `https://your-domain-name.example.com` and enjoy!
 
 > [!CAUTION]
-> Docker can have a cache layer, make sure you have the right build for each deployment or rebuild your project with --no-cache option to avoid cache issue.
+>
+> Docker can have a cache layer, make sure you have the right build for each deployment or rebuild your project with `--no-cache` option to avoid cache issue.
 
 ## Deploying on Multiple Nodes
 
 If you want to deploy your app on a cluster of machines, you can use [Docker Swarm](https://docs.docker.com/engine/swarm/stack-deploy/),
 which is compatible with the provided Compose files.
-To deploy on Kubernetes, take a look at [the Helm chart provided with API Platform](https://api-platform.com/docs/deployment/kubernetes/), which can be easily adapted for use with Symfony Docker.
+To deploy on Kubernetes, take a look at [the Helm chart provided with API Platform](https://api-platform.com/docs/deployment/kubernetes/), which uses FrankenPHP.

docs/static.md

@@ -43,7 +43,7 @@ docker buildx bake \
   static-builder
 ```
 
-See also: [customizing the build](#customizing-the-build)
+See also how to [customize the build](#customizing-the-build)
 
 ### GitHub Token
 
@@ -74,8 +74,10 @@ script to customize the static build:
 * `FRANKENPHP_VERSION`: the version of FrankenPHP to use
 * `PHP_VERSION`: the version of PHP to use
 * `PHP_EXTENSIONS`: the PHP extensions to build ([list of supported extensions](https://static-php.dev/en/guide/extensions.html))
-* `PHP_EXTENSION_LIBS`: extra libraries to build that add extra features to the extensions
+* `PHP_EXTENSION_LIBS`: extra libraries to build that add features to the extensions
 * `EMBED`: path of the PHP application to embed in the binary
 * `CLEAN`: when set, libphp and all its dependencies are built from scratch (no cache)
+* `NO_COMPRESS`: don't compress the resulting binary using UPX
 * `DEBUG_SYMBOLS`: when set, debug-symbols will not be stripped and will be added within the binary
+* `MIMALLOC`: (experimental, Linux-only) replace musl's mallocng by [mimalloc](https://github.com/microsoft/mimalloc) for improved performance
 * `RELEASE`: (maintainers only) when set, the resulting binary will be uploaded on GitHub

docs/tr/CONTRIBUTING.md

@@ -0,0 +1,202 @@
+# Katkıda Bulunmak
+
+## PHP Derleme
+
+### Docker ile (Linux)
+
+Geliştirme Ortamı için Docker İmajını Oluşturun:
+
+```console
+docker build -t frankenphp-dev -f dev.Dockerfile .
+docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -p 8080:8080 -p 443:443 -p 443:443/udp -v $PWD:/go/src/app -it frankenphp-dev
+```
+
+İmaj genel geliştirme araçlarını (Go, GDB, Valgrind, Neovim...) içerir.
+
+Docker sürümü 23.0'dan düşükse, derleme dockerignore [pattern issue](https://github.com/moby/moby/pull/42676) tarafından başarısız olur. Dizinleri `.dockerignore` dosyasına ekleyin.
+
+```patch
+ !testdata/*.php
+ !testdata/*.txt
++!caddy
++!internal
+```
+
+### Docker olmadan (Linux ve macOS)
+
+[Kaynaklardan derlemek için talimatları izleyin](https://frankenphp.dev/docs/compile/) ve `--debug` yapılandırma seçeneğini geçirin.
+
+## Test senaryolarını çalıştırma
+
+```console
+go test -race -v ./...
+```
+
+## Caddy modülü
+
+FrankenPHP Caddy modülü ile Caddy'yi oluşturun:
+
+```console
+cd caddy/frankenphp/
+go build
+cd ../../
+```
+
+Caddy'yi FrankenPHP Caddy modülü ile çalıştırın:
+
+```console
+cd testdata/
+../caddy/frankenphp/frankenphp run
+```
+
+Sunucu `127.0.0.1:8080` adresini dinliyor:
+
+```console
+curl -vk https://localhost/phpinfo.php
+```
+
+## Minimal test sunucusu
+
+Minimal test sunucusunu oluşturun:
+
+```console
+cd internal/testserver/
+go build
+cd ../../
+```
+
+Test sunucusunu çalıştırın:
+
+```console
+cd testdata/
+../internal/testserver/testserver
+```
+
+Sunucu `127.0.0.1:8080` adresini dinliyor:
+
+```console
+curl -v http://127.0.0.1:8080/phpinfo.php
+```
+
+## Docker İmajlarını Yerel Olarak Oluşturma
+
+Bake (pişirme) planını yazdırın:
+
+```console
+docker buildx bake -f docker-bake.hcl --print
+```
+
+Yerel olarak amd64 için FrankenPHP görüntüleri oluşturun:
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --load --set "*.platform=linux/amd64"
+```
+
+Yerel olarak arm64 için FrankenPHP görüntüleri oluşturun:
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --load --set "*.platform=linux/arm64"
+```
+
+FrankenPHP imajlarını arm64 ve amd64 için sıfırdan oluşturun ve Docker Hub'a gönderin:
+
+```console
+docker buildx bake -f docker-bake.hcl --pull --no-cache --push
+```
+
+## Statik Derlemelerle Segmentasyon Hatalarında Hata Ayıklama
+
+1. FrankenPHP binary dosyasının hata ayıklama sürümünü GitHub'dan indirin veya hata ayıklama seçeneklerini kullanarak özel statik derlemenizi oluşturun:
+
+    ```console
+    docker buildx bake \
+        --load \
+        --set static-builder.args.DEBUG_SYMBOLS=1 \
+        --set "static-builder.platform=linux/amd64" \
+        static-builder
+    docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/dist/frankenphp-linux-$(uname -m) frankenphp
+    ```
+
+2. Mevcut `frankenphp` sürümünüzü hata ayıklama FrankenPHP çalıştırılabilir dosyasıyla değiştirin
+3. FrankenPHP'yi her zamanki gibi başlatın (alternatif olarak FrankenPHP'yi doğrudan GDB ile başlatabilirsiniz: `gdb --args ./frankenphp run`)
+4. GDB ile sürece bağlanın:
+
+    ```console
+    gdb -p `pidof frankenphp`
+    ```
+
+5. Gerekirse, GDB kabuğuna `continue` yazın
+6. FrankenPHP'nin çökmesini sağlayın
+7. GDB kabuğuna `bt` yazın
+8. Çıktıyı kopyalayın
+
+## GitHub Eylemlerinde Segmentasyon Hatalarında Hata Ayıklama
+
+1. `.github/workflows/tests.yml` dosyasını açın
+2. PHP hata ayıklama seçeneklerini etkinleştirin
+
+    ```patch
+        - uses: shivammathur/setup-php@v2
+          # ...
+          env:
+            phpts: ts
+    +       debug: true
+    ```
+
+3. Konteynere bağlanmak için `tmate`i etkinleştirin
+
+    ```patch
+        -
+          name: Set CGO flags
+          run: echo "CGO_CFLAGS=$(php-config --includes)" >> "$GITHUB_ENV"
+    +   -
+    +     run: |
+    +       sudo apt install gdb
+    +       mkdir -p /home/runner/.config/gdb/
+    +       printf "set auto-load safe-path /\nhandle SIG34 nostop noprint pass" > /home/runner/.config/gdb/gdbinit
+    +   -
+    +     uses: mxschmitt/action-tmate@v3
+    ```
+
+4. Konteynere bağlanın
+5. `frankenphp.go` dosyasını açın
+6. `cgosymbolizer`'ı etkinleştirin
+
+    ```patch
+    -	//_ "github.com/ianlancetaylor/cgosymbolizer"
+    +	_ "github.com/ianlancetaylor/cgosymbolizer"
+    ```
+
+7. Modülü indirin: `go get`
+8. Konteynerde GDB ve benzerlerini kullanabilirsiniz:
+
+    ```console
+    go test -c -ldflags=-w
+    gdb --args ./frankenphp.test -test.run ^MyTest$
+    ```
+
+9. Hata düzeltildiğinde, tüm bu değişiklikleri geri alın
+
+## Misc Dev Resources
+
+* [uWSGI içine PHP gömme](https://github.com/unbit/uwsgi/blob/master/plugins/php/php_plugin.c)
+* [NGINX Unit'te PHP gömme](https://github.com/nginx/unit/blob/master/src/nxt_php_sapi.c)
+* [Go (go-php) içinde PHP gömme](https://github.com/deuill/go-php)
+* [Go'da PHP gömme (GoEmPHP)](https://github.com/mikespook/goemphp)
+* [C++'da PHP gömme](https://gist.github.com/paresy/3cbd4c6a469511ac7479aa0e7c42fea7)
+* [Sara Golemon tarafından PHP'yi Genişletme ve Yerleştirme](https://books.google.fr/books?id=zMbGvK17_tYC&pg=PA254&lpg=PA254#v=onepage&q&f=false)
+* [TSRMLS_CC de neyin nesi?](http://blog.golemon.com/2006/06/what-heck-is-tsrmlscc-anyway.html)
+* [Mac'te PHP gömme](https://gist.github.com/jonnywang/61427ffc0e8dde74fff40f479d147db4)
+* [SDL bağları](https://pkg.go.dev/github.com/veandco/go-sdl2@v0.4.21/sdl#Main)
+
+## Docker ile İlgili Kaynaklar
+
+* [Pişirme (bake) dosya tanımı](https://docs.docker.com/build/customize/bake/file-definition/)
+* [docker buildx build](https://docs.docker.com/engine/reference/commandline/buildx_build/)
+
+## Faydalı Komut
+
+```console
+apk add strace util-linux gdb
+strace -e 'trace=!futex,epoll_ctl,epoll_pwait,tgkill,rt_sigreturn' -p 1
+```

docs/tr/README.md

@@ -0,0 +1,77 @@
+# FrankenPHP: PHP için Modern Uygulama Sunucusu
+
+<h1 align="center"><a href="https://frankenphp.dev"><img src="frankenphp.png" alt="FrankenPHP" width="600"></a></h1>
+
+FrankenPHP, [Caddy](https://caddyserver.com/) web sunucusunun üzerine inşa edilmiş PHP için modern bir uygulama sunucusudur.
+
+FrankenPHP, çarpıcı özellikleri sayesinde PHP uygulamalarınıza süper güçler kazandırır: [Early Hints*](https://frankenphp.dev/docs/early-hints/), [worker modu](https://frankenphp.dev/docs/worker/), [real-time yetenekleri](https://frankenphp.dev/docs/mercure/), otomatik HTTPS, HTTP/2 ve HTTP/3 desteği...
+
+FrankenPHP herhangi bir PHP uygulaması ile çalışır ve worker modu ile resmi entegrasyonları sayesinde Laravel ve Symfony projelerinizi her zamankinden daha performanslı hale getirir.
+
+FrankenPHP, PHP'yi `net/http` kullanarak herhangi bir uygulamaya yerleştirmek için bağımsız bir Go kütüphanesi olarak da kullanılabilir.
+
+[*Frankenphp.dev*](https://frankenphp.dev) adresinden ve bu slayt üzerinden daha fazlasını öğrenin:
+
+<a href="https://dunglas.dev/2022/10/frankenphp-the-modern-php-app-server-written-in-go/"><img src="https://dunglas.dev/wp-content/uploads/2022/10/frankenphp.png" alt="Slides" width="600"></a>
+
+## Başlarken
+
+### Docker
+
+```console
+docker run -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+`https://localhost` adresine gidin ve keyfini çıkarın!
+
+> [!TIP]
+>
+> `https://127.0.0.1` kullanmaya çalışmayın. `https://localhost` kullanın ve kendinden imzalı sertifikayı kabul edin.
+> Kullanılacak alan adını değiştirmek için [`SERVER_NAME` ortam değişkenini](docs/config.md#environment-variables) kullanın.
+
+### Binary Çıktısı
+
+Docker kullanmayı tercih etmiyorsanız, Linux ve macOS için bağımsız FrankenPHP binary dosyası sağlıyoruz
+[PHP 8.3](https://www.php.net/releases/8.3/en.php) ve en popüler PHP eklentilerini de içermekte: [FrankenPHP](https://github.com/dunglas/frankenphp/releases) indirin
+
+Geçerli dizinin içeriğini başlatmak için çalıştırın:
+
+```console
+./frankenphp php-server
+```
+
+Ayrıca aşağıdaki tek komut satırı ile de çalıştırabilirsiniz:
+
+```console
+./frankenphp php-cli /path/to/your/script.php
+```
+
+## Docs
+
+* [Worker modu](https://frankenphp.dev/docs/worker/)
+* [Early Hints desteği (103 HTTP durum kodu)](https://frankenphp.dev/docs/early-hints/)
+* [Real-time](https://frankenphp.dev/docs/mercure/)
+* [Konfigürasyon](https://frankenphp.dev/docs/config/)
+* [Docker imajları](https://frankenphp.dev/docs/docker/)
+* [Production'a dağıtım](docs/production.md)
+* [**Bağımsız** kendiliğinden çalıştırılabilir PHP uygulamaları oluşturma](https://frankenphp.dev/docs/embed/)
+* [Statik binary'leri oluşturma](https://frankenphp.dev/docs/static/)
+* [Kaynak dosyalarından derleme](https://frankenphp.dev/docs/compile/)
+* [Laravel entegrasyonu](https://frankenphp.dev/docs/laravel/)
+* [Bilinen sorunlar](https://frankenphp.dev/docs/known-issues/)
+* [Demo uygulama (Symfony) ve kıyaslamalar](https://github.com/dunglas/frankenphp-demo)
+* [Go kütüphane dokümantasonu](https://pkg.go.dev/github.com/dunglas/frankenphp)
+* [Katkıda bulunma ve hata ayıklama](https://frankenphp.dev/docs/contributing/)
+
+## Örnekler ve İskeletler
+
+* [Symfony](https://github.com/dunglas/symfony-docker)
+* [API Platform](https://api-platform.com/docs/distribution/)
+* [Laravel](https://frankenphp.dev/docs/laravel/)
+* [Sulu](https://sulu.io/blog/running-sulu-with-frankenphp)
+* [WordPress](https://github.com/StephenMiracle/frankenwp)
+* [Drupal](https://github.com/dunglas/frankenphp-drupal)
+* [Joomla](https://github.com/alexandreelise/frankenphp-joomla)
+* [TYPO3](https://github.com/ochorocho/franken-typo3)

docs/tr/compile.md

@@ -0,0 +1,100 @@
+# Kaynak Kodlardan Derleme
+
+Bu doküman, PHP'yi dinamik bir kütüphane olarak yükleyecek bir FrankenPHP yapısının nasıl oluşturulacağını açıklamaktadır.
+Önerilen yöntem bu şekildedir.
+
+Alternatif olarak, [statik yapılar oluşturma](static.md) da mümkündür.
+
+## PHP'yi yükleyin
+
+FrankenPHP, PHP 8.2 ve üstü ile uyumludur.
+
+İlk olarak, [PHP'nin kaynaklarını edinin](https://www.php.net/downloads.php) ve bunları çıkarın:
+
+```console
+tar xf php-*
+cd php-*/
+```
+
+Ardından, PHP'yi platformunuz için yapılandırın.
+
+Bu şekilde yapılandırma gereklidir, ancak başka opsiyonlar da ekleyebilirsiniz (örn. ekstra uzantılar)
+İhtiyaç halinde.
+
+### Linux
+
+```console
+./configure \
+    --enable-embed \
+    --enable-zts \
+    --disable-zend-signals \
+    --enable-zend-max-execution-timers
+```
+
+### Mac
+
+Yüklemek için [Homebrew](https://brew.sh/) paket yöneticisini kullanın
+`libiconv`, `bison`, `re2c` ve `pkg-config`:
+
+```console
+brew install libiconv bison re2c pkg-config
+echo 'export PATH="/opt/homebrew/opt/bison/bin:$PATH"' >> ~/.zshrc
+```
+
+Ardından yapılandırma betiğini çalıştırın:
+
+```console
+./configure \
+    --enable-embed=static \
+    --enable-zts \
+    --disable-zend-signals \
+    --disable-opcache-jit \
+    --enable-static \
+    --enable-shared=no \
+    --with-iconv=/opt/homebrew/opt/libiconv/
+```
+
+## PHP Derleyin
+
+Son olarak, PHP'yi derleyin ve kurun:
+
+```console
+make -j"$(getconf _NPROCESSORS_ONLN)"
+sudo make install
+```
+
+## Go Uygulamasını Derleyin
+
+Artık Go kütüphanesini kullanabilir ve Caddy yapımızı derleyebilirsiniz:
+
+```console
+curl -L https://github.com/dunglas/frankenphp/archive/refs/heads/main.tar.gz | tar xz
+cd frankenphp-main/caddy/frankenphp
+CGO_CFLAGS=$(php-config --includes) CGO_LDFLAGS="$(php-config --ldflags) $(php-config --libs)" go build
+```
+
+### Xcaddy kullanımı
+
+Alternatif olarak, FrankenPHP'yi [özel Caddy modülleri](https://caddyserver.com/docs/modules/) ile derlemek için [xcaddy](https://github.com/caddyserver/xcaddy) kullanın:
+
+```console
+CGO_ENABLED=1 \
+XCADDY_GO_BUILD_FLAGS="-ldflags '-w -s'" \
+xcaddy build \
+    --output frankenphp \
+    --with github.com/dunglas/frankenphp/caddy \
+    --with github.com/dunglas/caddy-cbrotli \
+    --with github.com/dunglas/mercure/caddy \
+    --with github.com/dunglas/vulcain/caddy
+    # Add extra Caddy modules here
+```
+
+> [!TIP]
+>
+> Eğer musl libc (Alpine Linux'ta varsayılan) ve Symfony kullanıyorsanız,
+> varsayılan yığın boyutunu artırmanız gerekebilir.
+> Aksi takdirde, şu tarz hatalar alabilirsiniz `PHP Fatal error: Maximum call stack size of 83360 bytes reached during compilation. Try splitting expression`
+>
+> Bunu yapmak için, `XCADDY_GO_BUILD_FLAGS` ortam değişkenini bu şekilde değiştirin
+> `XCADDY_GO_BUILD_FLAGS=$'-ldflags "-w -s -extldflags \'-Wl,-z,stack-size=0x80000\'"'`
+> (yığın boyutunun değerini uygulamanızın ihtiyaçlarına göre değiştirin).

docs/tr/config.md

@@ -0,0 +1,157 @@
+# Konfigürasyon
+
+FrankenPHP, Caddy'nin yanı sıra Mercure ve Vulcain modülleri [Caddy tarafından desteklenen formatlar](https://caddyserver.com/docs/getting-started#your-first-config) kullanılarak yapılandırılabilir.
+
+Docker imajında, `Caddyfile` `/etc/caddy/Caddyfile` dosyası olarak bulunur.
+
+PHP'yi her zamanki gibi `php.ini` kullanarak da yapılandırabilirsiniz.
+
+Docker imajında `php.ini` dosyası mevcut değildir, elle oluşturabilir veya resmi bir şablonu kopyalayabilirsiniz:
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# Developement:
+RUN cp $PHP_INI_DIR/php.ini-development $PHP_INI_DIR/php.ini
+
+# Veya production:
+RUN cp $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
+```
+
+## Caddyfile Konfigürasyonu
+
+FrankenPHP yürütücüsünü kaydetmek için `frankenphp` [global seçenek](https://caddyserver.com/docs/caddyfile/concepts#global-options) ayarlanmalıdır, ardından PHP uygulamanızı sunmak için site blokları içinde `php_server` veya `php` [HTTP yönergeleri](https://caddyserver.com/docs/caddyfile/concepts#directives) kullanılabilir.
+
+Minimal örnek:
+
+```caddyfile
+{
+	# FrankenPHP'yi aktif et
+	frankenphp
+}
+
+localhost {
+	# Sıkıştırmayı etkinleştir (isteğe bağlı)
+	encode zstd br gzip
+	# Geçerli dizindeki PHP dosyalarını çalıştırın ve varlıkları sunun
+	php_server
+}
+```
+
+İsteğe bağlı olarak, oluşturulacak iş parçacığı sayısı ve sunucuyla birlikte başlatılacak [işçi betikleri] (worker.md) global seçenek altında belirtilebilir.
+
+```caddyfile
+{
+	frankenphp {
+		num_threads <num_threads> # Başlatılacak PHP iş parçacığı sayısını ayarlar. Varsayılan: Mevcut CPU çekirdek sayısının 2 katı.
+		worker {
+			file <path> # Çalışan komut dosyasının yolunu ayarlar.
+			num <num> # Başlatılacak PHP iş parçacığı sayısını ayarlar, varsayılan değer mevcut CPU çekirdek sayısının 2 katıdır.
+			env <key> <value> # Ek bir ortam değişkenini verilen değere ayarlar. Birden fazla ortam değişkeni için birden fazla kez belirtilebilir.
+		}
+	}
+}
+
+# ...
+```
+
+Alternatif olarak, `worker` seçeneğinin tek satırlık kısa formunu kullanabilirsiniz:
+
+```caddyfile
+{
+	frankenphp {
+		worker <file> <num>
+	}
+}
+
+# ...
+```
+
+Aynı sunucuda birden fazla uygulamaya hizmet veriyorsanız birden fazla işçi de tanımlayabilirsiniz:
+
+```caddyfile
+{
+	frankenphp {
+		worker /path/to/app/public/index.php <num>
+		worker /path/to/other/public/index.php <num>
+	}
+}
+
+app.example.com {
+	root * /path/to/app/public
+	php_server
+}
+
+other.example.com {
+	root * /path/to/other/public
+	php_server
+}
+
+# ...
+```
+
+Genellikle ihtiyacınız olan şey `php_server` yönergesini kullanmaktır,
+ancak tam kontrole ihtiyacınız varsa, daha düşük seviyeli `php` yönergesini kullanabilirsiniz:
+
+php_server` yönergesini kullanmak bu yapılandırmay ile aynıdır:
+
+```caddyfile
+route {
+	# Dizin istekleri için sondaki eğik çizgiyi, diğer adıyla taksim işaretini ekleyin
+	@canonicalPath {
+		file {path}/index.php
+		not path */
+	}
+	redir @canonicalPath {path}/ 308
+	# İstenen dosya mevcut değilse, dizin dosyalarını deneyin
+	@indexFiles file {
+		try_files {path} {path}/index.php index.php
+		split_path .php
+	}
+	rewrite @indexFiles {http.matchers.file.relative}
+	# FrankenPHP!
+	@phpFiles path *.php
+	php @phpFiles
+	file_server
+}
+```
+
+php_server` ve `php` yönergeleri aşağıdaki seçeneklere sahiptir:
+
+```caddyfile
+php_server [<matcher>] {
+	root <directory> # Sitenin kök klasörünü ayarlar. Öntanımlı: `root` yönergesi.
+	split_path <delim...> # URI'yi iki parçaya bölmek için alt dizgeleri ayarlar. İlk eşleşen alt dizge "yol bilgisini" yoldan ayırmak için kullanılır. İlk parça eşleşen alt dizeyle sonlandırılır ve gerçek kaynak (CGI betiği) adı olarak kabul edilir. İkinci parça betiğin kullanması için PATH_INFO olarak ayarlanacaktır. Varsayılan: `.php`
+	resolve_root_symlink false # Varsa, sembolik bir bağlantıyı değerlendirerek `root` dizininin gerçek değerine çözümlenmesini devre dışı bırakır (varsayılan olarak etkindir).
+	env <key> <value> # Ek bir ortam değişkenini verilen değere ayarlar. Birden fazla ortam değişkeni için birden fazla kez belirtilebilir.
+}
+```
+
+## Ortam Değişkenleri
+
+Aşağıdaki ortam değişkenleri `Caddyfile` içinde değişiklik yapmadan Caddy yönergelerini entegre etmek için kullanılabilir:
+
+* `SERVER_NAME`: değiştirin [dinlenecek adresleri](https://caddyserver.com/docs/caddyfile/concepts#addresses), sağlanan ana bilgisayar adları oluşturulan TLS sertifikası için de kullanılacaktır
+* `CADDY_GLOBAL_OPTIONS`: entegre edin [global seçenekler](https://caddyserver.com/docs/caddyfile/options)
+* `FRANKENPHP_CONFIG`: `frankenphp` yönergesi altına yapılandırma entegre edin
+
+FPM ve CLI SAPI'lerinde olduğu gibi, ortam değişkenleri varsayılan olarak `$_SERVER` süper globalinde gösterilir.
+
+[`variables_order`'a ait PHP yönergesinin](https://www.php.net/manual/en/ini.core.php#ini.variables-order) `S` değeri bu yönergede `E`'nin başka bir yere yerleştirilmesinden bağımsız olarak her zaman `ES` ile eş değerdir.
+
+## PHP konfigürasyonu
+
+Ek olarak [PHP yapılandırma dosyalarını](https://www.php.net/manual/en/configuration.file.php#configuration.file.scan) yüklemek için
+`PHP_INI_SCAN_DIR` ortam değişkeni kullanılabilir.
+Ayarlandığında, PHP verilen dizinlerde bulunan `.ini` uzantılı tüm dosyaları yükleyecektir.
+
+## Hata Ayıklama Modunu Etkinleştirin
+
+Docker imajını kullanırken, hata ayıklama modunu etkinleştirmek için `CADDY_GLOBAL_OPTIONS` ortam değişkenini `debug` olarak ayarlayın:
+
+```console
+docker run -v $PWD:/app/public \
+    -e CADDY_GLOBAL_OPTIONS=debug \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```

docs/tr/docker.md

@@ -0,0 +1,168 @@
+# Özel Docker İmajı Oluşturma
+
+[Resmi PHP imajları](https://hub.docker.com/_/php/) temel alınarak [FrankenPHP Docker imajları](https://hub.docker.com/r/dunglas/frankenphp) hazırlanmıştır. Popüler mimariler için Debian ve Alpine Linux varyantları sağlanmıştır. Debian dağıtımı tavsiye edilir.
+
+PHP 8.2 ve PHP 8.3 için varyantlar sağlanmıştır. [Etiketlere göz atın](https://hub.docker.com/r/dunglas/frankenphp/tags).
+
+## İmajlar Nasıl Kullanılır
+
+Projenizde bir `Dockerfile` oluşturun:
+
+```dockerfile
+FROM dunglas/frankenphp
+
+COPY . /app/public
+```
+
+Ardından, Docker imajını oluşturmak ve çalıştırmak için bu komutları çalıştırın:
+
+```console
+docker build -t my-php-app .
+docker run -it --rm --name my-running-app my-php-app
+```
+
+## Daha Fazla PHP Eklentisi Nasıl Kurulur
+
+[Docker-php-extension-installer`](https://github.com/mlocati/docker-php-extension-installer) betiği temel imajda sağlanmıştır.
+Ek PHP eklentileri eklemek ise gerçekten kolaydır:
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# buraya istenilen eklentileri ekleyin:
+RUN install-php-extensions \
+	pdo_mysql \
+	gd \
+	intl \
+	zip \
+	opcache
+```
+
+## Daha Fazla Caddy Modülü Nasıl Kurulur
+
+FrankenPHP, Caddy'nin üzerine inşa edilmiştir ve tüm [Caddy modülleri](https://caddyserver.com/docs/modules/) FrankenPHP ile kullanılabilir.
+
+Özel Caddy modüllerini kurmanın en kolay yolu [xcaddy](https://github.com/caddyserver/xcaddy) kullanmaktır:
+
+```dockerfile
+FROM dunglas/frankenphp:latest-builder AS builder
+
+# xcaddy'yi derleyen imaja kopyalayın
+COPY --from=caddy:builder /usr/bin/xcaddy /usr/bin/xcaddy
+
+# FrankenPHP oluşturmak için CGO etkinleştirilmelidir
+ENV CGO_ENABLED=1 XCADDY_SETCAP=1 XCADDY_GO_BUILD_FLAGS="-ldflags '-w -s'"
+RUN xcaddy build \
+	--output /usr/local/bin/frankenphp \
+	--with github.com/dunglas/frankenphp=./ \
+	--with github.com/dunglas/frankenphp/caddy=./caddy/ \
+	--with github.com/dunglas/caddy-cbrotli \
+	--with github.com/dunglas/caddy-cbrotli \
+	# Mercure ve Vulcain resmi yapıya dahil edilmiştir, ancak bunları kaldırmaktan çekinmeyin
+	--with github.com/dunglas/mercure/caddy \
+	--with github.com/dunglas/vulcain/caddy
+	# Buraya ekstra Caddy modülleri ekleyin
+
+FROM dunglas/frankenphp AS runner
+
+# Resmi binary dosyayı özel modüllerinizi içeren binary dosyayla değiştirin
+COPY --from=builder /usr/local/bin/frankenphp /usr/local/bin/frankenphp
+```
+
+FrankenPHP tarafından sağlanan `builder` imajı `libphp`'nin derlenmiş bir sürümünü içerir.
+[Derleyici imajları](https://hub.docker.com/r/dunglas/frankenphp/tags?name=builder) hem Debian hem de Alpine için FrankenPHP ve PHP'nin tüm sürümleri için sağlanmıştır.
+
+> [!TIP]
+>
+> Eğer Alpine Linux ve Symfony kullanıyorsanız,
+> [varsayılan yığın boyutunu artırmanız](compile.md#using-xcaddy) gerekebilir.
+
+## Varsayılan Olarak Worker Modunun Etkinleştirilmesi
+
+FrankenPHP'yi bir worker betiği ile başlatmak için `FRANKENPHP_CONFIG` ortam değişkenini ayarlayın:
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# ...
+
+ENV FRANKENPHP_CONFIG="worker ./public/index.php"
+```
+
+## Geliştirme Sürecinde Yığın (Volume) Kullanma
+
+FrankenPHP ile kolayca geliştirme yapmak için, uygulamanın kaynak kodunu içeren dizini ana bilgisayarınızdan Docker konteynerine bir yığın (volume) olarak bağlayın:
+
+```console
+docker run -v $PWD:/app/public -p 80:80 -p 443:443 -p 443:443/udp --tty my-php-app
+```
+
+> ![İPUCU]
+>
+> `--tty' seçeneği JSON günlükleri yerine insan tarafından okunabilir güzel günlüklere sahip olmayı sağlar.
+
+Docker Compose ile:
+
+```yaml
+# compose.yaml
+
+services:
+  php:
+    image: dunglas/frankenphp
+    # özel bir Dockerfile kullanmak istiyorsanız aşağıdaki yorum satırını kaldırın
+    #build: .
+    # bunu bir production ortamında çalıştırmak istiyorsanız aşağıdaki yorum satırını kaldırın
+    # restart: always
+    ports:
+      - "80:80" # HTTP
+      - "443:443" # HTTPS
+      - "443:443/udp" # HTTP/3
+    volumes:
+      - ./:/app/public
+      - caddy_data:/data
+      - caddy_config:/config
+    # production ortamda aşağıdaki satırı yorum satırı yapın, geliştirme ortamında insan tarafından okunabilir güzel günlüklere sahip olmanızı sağlar
+    tty: true
+
+# Caddy sertifikaları ve yapılandırması için gereken yığınlar (volumes)
+volumes:
+  caddy_data:
+  caddy_config:
+```
+
+## Root Olmayan Kullanıcı Olarak Çalıştırma
+
+FrankenPHP, Docker'da root olmayan kullanıcı olarak çalışabilir.
+
+İşte bunu yapan örnek bir `Dockerfile`:
+
+```dockerfile
+FROM dunglas/frankenphp
+
+ARG USER=www-data
+
+RUN \
+	# Alpine tabanlı dağıtımlar için "adduser -D ${USER}" kullanın
+	useradd -D ${USER}; \
+	# 80 ve 443 numaralı bağlantı noktalarına bağlanmak için ek özellik ekleyin
+	setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/frankenphp; \
+	# /data/caddy ve /config/caddy dosyalarına yazma erişimi verin
+	chown -R ${USER}:${USER} /data/caddy && chown -R ${USER}:${USER} /config/caddy;
+
+USER ${USER}
+```
+
+## Güncellemeler
+
+Docker imajları oluşturulur:
+
+* Yeni bir sürüm etiketlendiğinde
+* Her gün UTC ile saat 4'te Resmi PHP imajlarının yeni sürümleri mevcutsa
+
+## Geliştirme Sürümleri
+
+Geliştirme sürümleri [`dunglas/frankenphp-dev`](https://hub.docker.com/repository/docker/dunglas/frankenphp-dev) Docker deposunda mevcuttur.
+GitHub deposunun ana dalına her commit yapıldığında yeni bir derleme tetiklenir.
+
+`latest*` etiketleri `main` dalının başına işaret eder.
+`sha-<hash-du-commit-git>` biçimindeki etiketler de kullanılabilir.

docs/tr/early-hints.md

@@ -0,0 +1,21 @@
+# Early Hints
+
+FrankenPHP [103 Early Hints durum kodunu](https://developer.chrome.com/blog/early-hints/) yerel olarak destekler.
+Early Hints kullanmak web sayfalarınızın yüklenme süresini %30 oranında artırabilir.
+
+```php
+<?php
+
+header('Link: </style.css>; rel=preload; as=style');
+headers_send(103);
+
+// yavaş algoritmalarınız ve SQL sorgularınız 🤪
+
+echo <<<'HTML'
+<!DOCTYPE html>
+<title>Hello FrankenPHP</title>
+<link rel="stylesheet" href="style.css">
+HTML;
+```
+
+Early Hints hem normal hem de [worker](worker.md) modları tarafından desteklenir.

docs/tr/embed.md

@@ -0,0 +1,132 @@
+# Binary Dosyası Olarak PHP Uygulamaları
+
+FrankenPHP, PHP uygulamalarının kaynak kodunu ve varlıklarını statik, kendi kendine yeten bir binary dosyaya yerleştirme yeteneğine sahiptir.
+
+Bu özellik sayesinde PHP uygulamaları, uygulamanın kendisini, PHP yorumlayıcısını ve üretim düzeyinde bir web sunucusu olan Caddy'yi içeren bağımsız bir binary dosyalar olarak çıktısı alınabilir ve dağıtılabilir.
+
+Bu özellik hakkında daha fazla bilgi almak için [Kévin tarafından SymfonyCon 2023'te yapılan sunuma](https://dunglas.dev/2023/12/php-and-symfony-apps-as-standalone-binaries/) göz atabilirsiniz.
+
+## Preparing Your App
+
+Bağımsız binary dosyayı oluşturmadan önce uygulamanızın gömülmeye hazır olduğundan emin olun.
+
+Örneğin muhtemelen şunları yapmak istersiniz:
+
+* Uygulamanın üretim bağımlılıklarını yükleyin
+* Otomatik yükleyiciyi boşaltın
+* Uygulamanızın üretim modunu etkinleştirin (varsa)
+* Nihai binary dosyanızın boyutunu küçültmek için `.git` veya testler gibi gerekli olmayan dosyaları çıkarın
+
+Örneğin, bir Symfony uygulaması için aşağıdaki komutları kullanabilirsiniz:
+
+```console
+# .git/, vb. dosyalarından kurtulmak için projeyi dışa aktarın
+mkdir $TMPDIR/my-prepared-app
+git archive HEAD | tar -x -C $TMPDIR/my-prepared-app
+cd $TMPDIR/my-prepared-app
+
+# Uygun ortam değişkenlerini ayarlayın
+echo APP_ENV=prod > .env.local
+echo APP_DEBUG=0 >> .env.local
+
+# Testleri kaldırın
+rm -Rf tests/
+
+# Bağımlılıkları yükleyin
+composer install --ignore-platform-reqs --no-dev -a
+
+# .env'yi optimize edin
+composer dump-env prod
+```
+
+## Linux Binary'si Oluşturma
+
+Bir Linux binary çıktısı almanın en kolay yolu, sağladığımız Docker tabanlı derleyiciyi kullanmaktır.
+
+1. Hazırladığınız uygulamanın deposunda `static-build.Dockerfile` adlı bir dosya oluşturun:
+
+    ```dockerfile
+    FROM --platform=linux/amd64 dunglas/frankenphp:static-builder
+
+    # Uygulamanızı kopyalayın
+    WORKDIR /go/src/app/dist/app
+    COPY . .
+
+    # Statik binary dosyasını oluşturun, yalnızca istediğiniz PHP eklentilerini seçtiğinizden emin olun
+    WORKDIR /go/src/app/
+    RUN EMBED=dist/app/ \
+        PHP_EXTENSIONS=ctype,iconv,pdo_sqlite \
+        ./build-static.sh
+    ```
+
+   > [!CAUTION]
+   >
+   > Bazı `.dockerignore` dosyaları (örneğin varsayılan [Symfony Docker `.dockerignore`](https://github.com/dunglas/symfony-docker/blob/main/.dockerignore))
+   > `vendor/` dizinini ve `.env` dosyalarını yok sayacaktır. Derlemeden önce `.dockerignore` dosyasını ayarladığınızdan veya kaldırdığınızdan emin olun.
+
+2. Derleyin:
+
+    ```console
+    docker build -t static-app -f static-build.Dockerfile .
+    ```
+
+3. Binary dosyasını çıkarın:
+
+    ```console
+    docker cp $(docker create --name static-app-tmp static-app):/go/src/app/dist/frankenphp-linux-x86_64 my-app ; docker rm static-app-tmp
+    ```
+
+Elde edilen binary dosyası, geçerli dizindeki `my-app` adlı dosyadır.
+
+## Diğer İşletim Sistemleri için Binary Çıktısı Alma
+
+Docker kullanmak istemiyorsanız veya bir macOS binary dosyası oluşturmak istiyorsanız, sağladığımız kabuk betiğini kullanın:
+
+```console
+git clone https://github.com/dunglas/frankenphp
+cd frankenphp
+EMBED=/path/to/your/app \
+    PHP_EXTENSIONS=ctype,iconv,pdo_sqlite \
+    ./build-static.sh
+```
+
+Elde edilen binary dosyası `dist/` dizinindeki `frankenphp-<os>-<arch>` adlı dosyadır.
+
+## Binary Dosyasını Kullanma
+
+İşte bu kadar! `my-app` dosyası (veya diğer işletim sistemlerinde `dist/frankenphp-<os>-<arch>`) bağımsız uygulamanızı içerir!
+
+Web uygulamasını başlatmak için çalıştırın:
+
+```console
+./my-app php-server
+```
+
+Uygulamanız bir [worker betiği](worker.md) içeriyorsa, worker'ı aşağıdaki gibi bir şeyle başlatın:
+
+```console
+./my-app php-server --worker public/index.php
+```
+
+HTTPS (Let's Encrypt sertifikası otomatik olarak oluşturulur), HTTP/2 ve HTTP/3'ü etkinleştirmek için kullanılacak alan adını belirtin:
+
+```console
+./my-app php-server --domain localhost
+```
+
+Ayrıca binary dosyanıza gömülü PHP CLI betiklerini de çalıştırabilirsiniz:
+
+```console
+./my-app php-cli bin/console
+```
+
+## Yapıyı Özelleştirme
+
+Binary dosyasının nasıl özelleştirileceğini (uzantılar, PHP sürümü...) görmek için [Statik derleme dokümanını okuyun](static.md).
+
+## Binary Dosyasının Dağıtılması
+
+Linux'ta, oluşturulan ikili dosya [UPX](https://upx.github.io) kullanılarak sıkıştırılır.
+
+Mac'te, göndermeden önce dosyanın boyutunu küçültmek için sıkıştırabilirsiniz.
+Biz `xz` öneririz.

docs/tr/github-actions.md

@@ -0,0 +1,31 @@
+# GitHub Actions Kullanma
+
+Bu depo Docker imajını [Docker Hub](https://hub.docker.com/r/dunglas/frankenphp) üzerinde derler ve dağıtır.
+Bu durum onaylanan her çekme (pull) isteğinde veya çatallandıktan (fork) sonra gerçekleşir.
+
+## GitHub Eylemlerini Ayarlama
+
+Depo ayarlarında, gizli değerler altında aşağıdaki gizli değerleri ekleyin:
+
+- `REGISTRY_LOGIN_SERVER`: Kullanılacak Docker Registry bilgisi (örneğin `docker.io`).
+- `REGISTRY_USERNAME`: Giriş yapmak için kullanılacak kullanıcı adı (örn. `dunglas`).
+- `REGISTRY_PASSWORD`: Oturum açmak için kullanılacak parola (örn. bir erişim anahtarı).
+- `IMAGE_NAME`: İmajın adı (örn. `dunglas/frankenphp`).
+
+## İmajı Oluşturma ve Dağıtma
+
+1. Bir Çekme (pull) İsteği oluşturun veya çatala (forka) dağıtın.
+2. GitHub Actions imajı oluşturacak ve tüm testleri çalıştıracaktır.
+3. Derleme başarılı olursa, görüntü `pr-x` (burada `x` PR numarasıdır) etiketi kullanılarak ilgili saklanan yere (registry'e) gönderilir.
+
+## İmajı Dağıtma
+
+1. Çekme (pull) isteği birleştirildikten sonra, GitHub Actions testleri tekrar çalıştıracak ve yeni bir imaj oluşturacaktır.
+2. Derleme başarılı olursa, `main` etiketi Docker Registry'de güncellenecektir.
+
+## Bültenler
+
+1. Depoda yeni bir etiket oluşturun.
+2. GitHub Actions imajı oluşturacak ve tüm testleri çalıştıracaktır.
+3. Derleme başarılı olursa, etiket adı etiket olarak kullanılarak imaj saklanan yere (registry'e) gönderilir (örneğin `v1.2.3` ve `v1.2` oluşturulur).
+4. `latest` etiketi de güncellenecektir.

docs/tr/known-issues.md

@@ -0,0 +1,137 @@
+# Bilinen Sorunlar
+
+## Fibers
+
+[Fibers](https://www.php.net/manual/en/language.fibers.php) içinde [cgo](https://go.dev/blog/cgo) çağrısı yapan PHP fonksiyonlarının ve dil yapılarının çağrılmasının çökmelere neden olduğu bilinmektedir.
+
+Bu sorun [Go projesi tarafından üzerinde çalışılmaktadır](https://github.com/golang/go/issues/62130).
+
+Bu arada, bir çözüm Fibers içinden Go'ya temsilci atayan yapıları (`echo` gibi) ve fonksiyonları (`header()` gibi) kullanmamaktır.
+
+Bu kod, Fiber içinde `echo` kullandığı için büyük olasılıkla çökecektir:
+
+```php
+$fiber = new Fiber(function() {
+    echo 'In the Fiber'.PHP_EOL;
+    echo 'Still inside'.PHP_EOL;
+});
+$fiber->start();
+```
+
+Bunun yerine, değeri Fiber'den döndürün ve dışarıda kullanın:
+
+```php
+$fiber = new Fiber(function() {
+    Fiber::suspend('In the Fiber'.PHP_EOL));
+    Fiber::suspend('Still inside'.PHP_EOL));
+});
+echo $fiber->start();
+echo $fiber->resume();
+$fiber->resume();
+```
+
+## Desteklenmeyen PHP Eklentileri
+
+Aşağıdaki eklentilerin FrankenPHP ile uyumlu olmadığı bilinmektedir:
+
+| Adı                                                         | Nedeni                     | Alternatifleri                                                                                                       |
+|-------------------------------------------------------------|----------------------------|----------------------------------------------------------------------------------------------------------------------|
+| [imap](https://www.php.net/manual/en/imap.installation.php) | İş parçacığı güvenli değil | [javanile/php-imap2](https://github.com/javanile/php-imap2), [webklex/php-imap](https://github.com/Webklex/php-imap) |
+
+## Sorunlu PHP Eklentileri
+
+Aşağıdaki eklentiler FrankenPHP ile kullanıldığında bilinen hatalara ve beklenmeyen davranışlara sahiptir:
+
+| Adı                               | Problem                                                                                                                                                                                                                                                    |
+|-----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+
+## get_browser
+
+[get_browser()](https://www.php.net/manual/en/function.get-browser.php) fonksiyonu bir süre sonra kötü performans gösteriyor gibi görünüyor. Geçici bir çözüm, statik oldukları için User-Agent başına sonuçları önbelleğe almaktır (örneğin [APCu](https://www.php.net/manual/en/book.apcu.php) ile).
+
+## Binary Çıktısı ve Alpine Tabanlı Docker İmajları
+
+Binary çıktısı ve Alpine tabanlı Docker imajları (dunglas/frankenphp:*-alpine), daha küçük bir binary boyutu korumak için glibc ve arkadaşları yerine musl libc kullanır. Bu durum bazı uyumluluk sorunlarına yol açabilir. Özellikle, glob seçeneği GLOB_BRACE mevcut değildir.
+
+## Docker ile `https://127.0.0.1` Kullanımı
+
+FrankenPHP varsayılan olarak `localhost` için bir TLS sertifikası oluşturur.
+Bu, yerel geliştirme için en kolay ve önerilen seçenektir.
+
+Bunun yerine ana bilgisayar olarak `127.0.0.1` kullanmak istiyorsanız, sunucu adını `127.0.0.1` şeklinde ayarlayarak bunun için bir sertifika oluşturacak yapılandırma yapmak mümkündür.
+
+Ne yazık ki, [ağ sistemi](https://docs.docker.com/network/) nedeniyle Docker kullanırken bu yeterli değildir.
+`Curl: (35) LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error`'a benzer bir TLS hatası alırsınız.
+
+Linux kullanıyorsanız, [ana bilgisayar ağ sürücüsünü](https://docs.docker.com/network/network-tutorial-host/) kullanmak bir çözümdür:
+
+```console
+docker run \
+    -e SERVER_NAME="127.0.0.1" \
+    -v $PWD:/app/public \
+    --network host \
+    dunglas/frankenphp
+```
+
+Ana bilgisayar ağ sürücüsü Mac ve Windows'ta desteklenmez. Bu platformlarda, konteynerin IP adresini tahmin etmeniz ve bunu sunucu adlarına dahil etmeniz gerekecektir.
+
+`docker network inspect bridge`'i çalıştırın ve `IPv4Address` anahtarının altındaki son atanmış IP adresini belirlemek için `Containers` anahtarına bakın ve bir artırın. Eğer hiçbir konteyner çalışmıyorsa, ilk atanan IP adresi genellikle `172.17.0.2`dir.
+
+Ardından, bunu `SERVER_NAME` ortam değişkenine ekleyin:
+
+```console
+docker run \
+    -e SERVER_NAME="127.0.0.1, 172.17.0.3" \
+    -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+> [!CAUTION]
+>
+> 172.17.0.3`ü konteynerinize atanacak IP ile değiştirdiğinizden emin olun.
+
+Artık ana makineden `https://127.0.0.1` adresine erişebilmeniz gerekir.
+
+Eğer durum böyle değilse, sorunu anlamaya çalışmak için FrankenPHP'yi hata ayıklama modunda başlatın:
+
+```console
+docker run \
+    -e CADDY_GLOBAL_OPTIONS="debug" \
+    -e SERVER_NAME="127.0.0.1" \
+    -v $PWD:/app/public \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+## `@php` Referanslı Composer Betikler
+
+[Composer betikleri](https://getcomposer.org/doc/articles/scripts.md) bazı görevler için bir PHP binary çalıştırmak isteyebilir, örneğin [bir Laravel projesinde](laravel.md) `@php artisan package:discover --ansi` çalıştırmak. Bu [şu anda mümkün değil](https://github.com/dunglas/frankenphp/issues/483#issuecomment-1899890915) ve 2 nedeni var:
+
+* Composer FrankenPHP binary dosyasını nasıl çağıracağını bilmiyor;
+* Composer, FrankenPHP'nin henüz desteklemediği `-d` bayrağını kullanarak PHP ayarlarını komuta ekleyebilir.
+
+Geçici bir çözüm olarak, `/usr/local/bin/php` içinde desteklenmeyen parametreleri silen ve ardından FrankenPHP'yi çağıran bir kabuk betiği oluşturabiliriz:
+
+```bash
+#!/bin/bash
+args=("$@")
+index=0
+for i in "$@"
+do
+    if [ "$i" == "-d" ]; then
+        unset 'args[$index]'
+        unset 'args[$index+1]'
+    fi
+    index=$((index+1))
+done
+
+/usr/local/bin/frankenphp php-cli ${args[@]}
+```
+
+Ardından `PHP_BINARY` ortam değişkenini PHP betiğimizin yoluna ayarlayın ve Composer bu yolla çalışacaktır:
+
+```bash
+export PHP_BINARY=/usr/local/bin/php
+composer install
+```

docs/tr/laravel.md

@@ -0,0 +1,74 @@
+# Laravel
+
+## Docker
+
+Bir [Laravel](https://laravel.com) web uygulamasını FrankenPHP ile çalıştırmak, projeyi resmi Docker imajının `/app` dizinine monte etmek kadar kolaydır.
+
+Bu komutu Laravel uygulamanızın ana dizininden çalıştırın:
+
+```console
+docker run -p 80:80 -p 443:443 -p 443:443/udp -v $PWD:/app dunglas/frankenphp
+```
+
+And tadını çıkarın!
+
+## Yerel Kurulum
+
+Alternatif olarak, Laravel projelerinizi FrankenPHP ile yerel makinenizden çalıştırabilirsiniz:
+
+1. [Sisteminize karşılık gelen binary dosyayı indirin](https://github.com/dunglas/frankenphp/releases)
+2. Aşağıdaki yapılandırmayı Laravel projenizin kök dizinindeki `Caddyfile` adlı bir dosyaya ekleyin:
+
+    ```caddyfile
+    {
+    	frankenphp
+    }
+
+    # Sunucunuzun alan adı
+    localhost {
+    	# Webroot'u public/ dizinine ayarlayın
+    	root * public/
+    	# Sıkıştırmayı etkinleştir (isteğe bağlı)
+    	encode zstd br gzip
+    	# PHP dosyalarını public/ dizininden çalıştırın ve varlıkları sunun
+    	php_server
+    }
+    ```
+
+3. FrankenPHP'yi Laravel projenizin kök dizininden başlatın: `./frankenphp run`
+
+## Laravel Octane
+
+Octane, Composer paket yöneticisi aracılığıyla kurulabilir:
+
+```console
+composer require laravel/octane
+```
+
+Octane'ı kurduktan sonra, Octane'ın yapılandırma dosyasını uygulamanıza yükleyecek olan `octane:install` Artisan komutunu çalıştırabilirsiniz:
+
+```console
+php artisan octane:install --server=frankenphp
+```
+
+Octane sunucusu `octane:frankenphp` Artisan komutu aracılığıyla başlatılabilir.
+
+```console
+php artisan octane:frankenphp
+```
+
+`octane:frankenphp` komutu aşağıdaki seçenekleri alabilir:
+
+* `--host`: Sunucunun bağlanması gereken IP adresi (varsayılan: `127.0.0.1`)
+* `--port`: Sunucunun erişilebilir olması gereken port (varsayılan: `8000`)
+* `--admin-port`: Yönetici sunucusunun erişilebilir olması gereken port (varsayılan: `2019`)
+* `--workers`: İstekleri işlemek için hazır olması gereken worker sayısı (varsayılan: `auto`)
+* `--max-requests`: Sunucu yeniden yüklenmeden önce işlenecek istek sayısı (varsayılan: `500`)
+* `--caddyfile`: FrankenPHP `Caddyfile` dosyasının yolu
+* `--https`: HTTPS, HTTP/2 ve HTTP/3'ü etkinleştirin ve sertifikaları otomatik olarak oluşturup yenileyin
+* `--http-redirect`: HTTP'den HTTPS'ye yeniden yönlendirmeyi etkinleştir (yalnızca --https geçilirse etkinleştirilir)
+* `--watch`: Uygulamada kod değişikliği olduğunda sunucuyu otomatik olarak yeniden yükle
+* `--poll`: Dosyaları bir ağ üzerinden izlemek için izleme sırasında dosya sistemi yoklamasını kullanın
+* `--log-level`: Belirtilen günlük seviyesinde veya üzerinde günlük mesajları
+
+Laravel Octane hakkında daha fazla bilgi edinmek için [Laravel Octane resmi belgelerine](https://laravel.com/docs/octane) göz atın.

docs/tr/mercure.md

@@ -0,0 +1,12 @@
+# Gerçek Zamanlı
+
+FrankenPHP yerleşik bir [Mercure](https://mercure.rocks) hub ile birlikte gelir!
+Mercure, olayları tüm bağlı cihazlara gerçek zamanlı olarak göndermeye olanak tanır: anında bir JavaScript olayı alırlar.
+
+JS kütüphanesi veya SDK gerekmez!
+
+![Mercure](../mercure-hub.png)
+
+Mercure hub'ını etkinleştirmek için [Mercure'ün sitesinde](https://mercure.rocks/docs/hub/config) açıklandığı gibi `Caddyfile`'ı güncelleyin.
+
+Mercure güncellemelerini kodunuzdan göndermek için [Symfony Mercure Bileşenini](https://symfony.com/components/Mercure) öneririz (kullanmak için Symfony tam yığın çerçevesine ihtiyacınız yoktur).

docs/tr/production.md

@@ -0,0 +1,139 @@
+# Production Ortamına Dağıtım
+
+Bu dokümanda, Docker Compose kullanarak bir PHP uygulamasını tek bir sunucuya nasıl dağıtacağımızı öğreneceğiz.
+
+Symfony kullanıyorsanız, Symfony Docker projesinin (FrankenPHP kullanan) "[Production ortamına dağıtım](https://github.com/dunglas/symfony-docker/blob/main/docs/production.md)" dokümanını okumayı tercih edebilirsiniz.
+
+API Platform (FrankenPHP de kullanır) tercih ediyorsanız, [çerçevenin dağıtım dokümanına](https://api-platform.com/docs/deployment/) bakabilirsiniz.
+
+## Uygulamanızı Hazırlama
+
+İlk olarak, PHP projenizin kök dizininde bir `Dockerfile` oluşturun:
+
+```dockerfile
+FROM dunglas/frankenphp
+
+# "your-domain-name.example.com" yerine kendi alan adınızı yazdığınızdan emin olun
+ENV SERVER_NAME=your-domain-name.example.com
+# HTTPS'yi devre dışı bırakmak istiyorsanız, bunun yerine bu değeri kullanın:
+#ENV SERVER_NAME=:80
+
+# PHP production ayarlarını etkinleştirin
+RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
+
+# Projenizin PHP dosyalarını genel dizine kopyalayın
+COPY . /app/public
+# Symfony veya Laravel kullanıyorsanız, bunun yerine tüm projeyi kopyalamanız gerekir:
+#COPY . /app
+```
+
+Daha fazla ayrıntı ve seçenek için "[Özel Docker İmajı Oluşturma](docker.md)" bölümüne bakın,
+ve yapılandırmayı nasıl özelleştireceğinizi öğrenmek için PHP eklentilerini ve Caddy modüllerini yükleyin.
+
+Projeniz Composer kullanıyorsa,
+Docker imajına dahil ettiğinizden ve bağımlılıklarınızı yüklediğinizden emin olun.
+
+Ardından, bir `compose.yaml` dosyası ekleyin:
+
+```yaml
+services:
+  php:
+    image: dunglas/frankenphp
+    restart: always
+    ports:
+      - "80:80" # HTTP
+      - "443:443" # HTTPS
+      - "443:443/udp" # HTTP/3
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+
+# Caddy sertifikaları ve yapılandırması için gereken yığınlar (volumes)
+volumes:
+  caddy_data:
+  caddy_config:
+```
+
+> [!NOTE]
+>
+> Önceki örnekler production kullanımı için tasarlanmıştır.
+> Geliştirme aşamasında, bir yığın (volume), farklı bir PHP yapılandırması ve `SERVER_NAME` ortam değişkeni için farklı bir değer kullanmak isteyebilirsiniz.
+>
+> (FrankenPHP kullanan) çok aşamalı Composer, ekstra PHP eklentileri vb. içeren imajlara başvuran daha gelişmiş bir örnek için [Symfony Docker](https://github.com/dunglas/symfony-docker) projesine bir göz atın.
+
+Son olarak, eğer Git kullanıyorsanız, bu dosyaları commit edin ve push edin.
+
+## Sunucu Hazırlama
+
+Uygulamanızı production ortamına dağıtmak için bir sunucuya ihtiyacınız vardır.
+Bu dokümanda, DigitalOcean tarafından sağlanan bir sanal makine kullanacağız, ancak herhangi bir Linux sunucusu çalışabilir.
+Docker yüklü bir Linux sunucunuz varsa, doğrudan [bir sonraki bölüme](#alan-adı-yapılandırma) geçebilirsiniz.
+
+Aksi takdirde, 200 $ ücretsiz kredi almak için [bu ortaklık bağlantısını](https://m.do.co/c/5d8aabe3ab80) kullanın, bir hesap oluşturun ve ardından "Create a Droplet" seçeneğine tıklayın.
+Ardından, "Bir imaj seçin" bölümünün altındaki "Marketplace" sekmesine tıklayın ve "Docker" adlı uygulamayı bulun.
+Bu, Docker ve Docker Compose'un en son sürümlerinin zaten yüklü olduğu bir Ubuntu sunucusu sağlayacaktır!
+
+Test amaçlı kullanım için en ucuz planlar yeterli olacaktır.
+Gerçek production kullanımı için, muhtemelen ihtiyaçlarınıza uyacak şekilde "genel amaçlı" bölümünden bir plan seçmek isteyeceksiniz.
+
+![Docker ile DigitalOcean FrankenPHP](digitalocean-droplet.png)
+
+Diğer ayarlar için varsayılanları koruyabilir veya ihtiyaçlarınıza göre değiştirebilirsiniz.
+SSH anahtarınızı eklemeyi veya bir parola oluşturmayı unutmayın, ardından "Sonlandır ve oluştur" düğmesine basın.
+
+Ardından, Droplet'iniz hazırlanırken birkaç saniye bekleyin.
+Droplet'iniz hazır olduğunda, bağlanmak için SSH kullanın:
+
+```console
+ssh root@<droplet-ip>
+```
+
+## Alan Adı Yapılandırma
+
+Çoğu durumda sitenizle bir alan adını ilişkilendirmek isteyeceksiniz.
+Henüz bir alan adınız yoksa, bir kayıt şirketi aracılığıyla bir alan adı satın almanız gerekir.
+
+Daha sonra alan adınız için sunucunuzun IP adresini işaret eden `A` türünde bir DNS kaydı oluşturun:
+
+```dns
+your-domain-name.example.com.  IN  A     207.154.233.113
+```
+
+DigitalOcean Alan Adları hizmetiyle ilgili örnek ("Networking" > "Domains"):
+
+![DigitalOcean'da DNS Yapılandırma](digitalocean-dns.png)
+
+> [!NOTE]
+>
+> FrankenPHP tarafından varsayılan olarak otomatik olarak TLS sertifikası oluşturmak için kullanılan hizmet olan Let's Encrypt, direkt IP adreslerinin kullanılmasını desteklemez. Let's Encrypt'i kullanmak için alan adı kullanmak zorunludur.
+
+## Dağıtım
+
+Projenizi `git clone`, `scp` veya ihtiyacınıza uygun başka bir araç kullanarak sunucuya kopyalayın.
+GitHub kullanıyorsanız [bir dağıtım anahtarı](https://docs.github.com/en/free-pro-team@latest/developers/overview/managing-deploy-keys#deploy-keys) kullanmak isteyebilirsiniz.
+Dağıtım anahtarları ayrıca [GitLab tarafından desteklenir](https://docs.gitlab.com/ee/user/project/deploy_keys/).
+
+Git ile örnek:
+
+```console
+git clone git@github.com:<username>/<project-name>.git
+```
+
+Projenizi içeren dizine gidin (`<proje-adı>`) ve uygulamayı production modunda başlatın:
+
+```console
+docker compose up -d --wait
+```
+
+Sunucunuz hazır ve çalışıyor. Sizin için otomatik olarak bir HTTPS sertifikası oluşturuldu.
+`https://your-domain-name.example.com` adresine gidin ve keyfini çıkarın!
+
+> [!CAUTION]
+>
+> Docker bir önbellek katmanına sahip olabilir, her dağıtım için doğru derlemeye sahip olduğunuzdan emin olun veya önbellek sorununu önlemek için projenizi `--no-cache` seçeneği ile yeniden oluşturun.
+
+## Birden Fazla Düğümde Dağıtım
+
+Uygulamanızı bir makine kümesine dağıtmak istiyorsanız, [Docker Swarm](https://docs.docker.com/engine/swarm/stack-deploy/) kullanabilirsiniz,
+sağlanan Compose dosyaları ile uyumludur.
+Kubernetes üzerinde dağıtım yapmak için FrankenPHP kullanan [API Platformu ile sağlanan Helm grafiğine](https://api-platform.com/docs/deployment/kubernetes/) göz atın.

docs/tr/static.md

@@ -0,0 +1,81 @@
+# Statik Yapı Oluşturun
+
+PHP kütüphanesinin yerel kurulumunu kullanmak yerine,
+harika [static-php-cli projesi](https://github.com/crazywhalecc/static-php-cli) sayesinde FrankenPHP'nin statik bir yapısını oluşturmak mümkündür (adına rağmen, bu proje sadece CLI'yi değil, tüm SAPI'leri destekler).
+
+Bu yöntemle, tek, taşınabilir bir ikili PHP yorumlayıcısını, Caddy web sunucusunu ve FrankenPHP'yi içerecektir!
+
+FrankenPHP ayrıca [PHP uygulamasının statik binary gömülmesini](embed.md) destekler.
+
+## Linux
+
+Linux statik binary dosyası oluşturmak için bir Docker imajı sağlıyoruz:
+
+```console
+docker buildx bake --load static-builder
+docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/dist/frankenphp-linux-$(uname -m) frankenphp ; docker rm static-builder
+```
+
+Elde edilen statik binary `frankenphp` olarak adlandırılır ve geçerli dizinde kullanılabilir.
+
+Statik binary dosyasını Docker olmadan oluşturmak istiyorsanız, Linux için de çalışan macOS talimatlarına bir göz atın.
+
+### Özel Eklentiler
+
+Varsayılan olarak, en popüler PHP eklentileri zaten derlenir.
+
+Binary dosyanın boyutunu küçültmek ve saldırı yüzeyini azaltmak için `PHP_EXTENSIONS` Docker ARG'sini kullanarak derlenecek eklentilerin listesini seçebilirsiniz.
+
+Örneğin, yalnızca `opcache` eklentisini derlemek için aşağıdaki komutu çalıştırın:
+
+```console
+docker buildx bake --load --set static-builder.args.PHP_EXTENSIONS=opcache,pdo_sqlite static-builder
+# ...
+```
+
+Etkinleştirdiğiniz eklentilere ek işlevler sağlayan kütüphaneler eklemek için `PHP_EXTENSION_LIBS` Docker ARG'sini kullanabilirsiniz:
+
+```console
+docker buildx bake \
+  --load \
+  --set static-builder.args.PHP_EXTENSIONS=gd \
+  --set static-builder.args.PHP_EXTENSION_LIBS=libjpeg,libwebp \
+  static-builder
+```
+
+Derlemeyi nasıl [özelleştireceğinize](#yapıyı-özelleştirme) de bakın.
+
+### GitHub Token
+
+GitHub API kullanım limitine ulaşırsanız, `GITHUB_TOKEN` adlı bir ortam değişkeninde bir GitHub Personal Access Token ayarlayın:
+
+```console
+GITHUB_TOKEN="xxx" docker --load buildx bake static-builder
+# ...
+```
+
+## macOS
+
+macOS için statik bir binary oluşturmak için aşağıdaki betiği çalıştırın ([Homebrew](https://brew.sh/) yüklü olmalıdır):
+
+```console
+git clone https://github.com/dunglas/frankenphp
+cd frankenphp
+./build-static.sh
+```
+
+Not: Bu betik Linux'ta (ve muhtemelen diğer Unix'lerde) da çalışır ve sağladığımız Docker tabanlı statik derleyici tarafından dahili olarak kullanılır.
+
+## Yapıyı Özelleştirme
+
+Aşağıdaki ortam değişkenleri `docker build` ve `build-static.sh` dosyalarına aktarılabilir
+statik derlemeyi özelleştirmek için betik:
+
+* `FRANKENPHP_VERSION`: kullanılacak FrankenPHP sürümü
+* `PHP_VERSION`: kullanılacak PHP sürümü
+* `PHP_EXTENSIONS`: oluşturulacak PHP eklentileri ([desteklenen eklentiler listesi](https://static-php.dev/en/guide/extensions.html))
+* `PHP_EXTENSION_LIBS`: eklentilere özellikler ekleyen oluşturulacak ekstra kütüphaneler
+* `EMBED`: binary dosyaya gömülecek PHP uygulamasının yolu
+* `CLEAN`: ayarlandığında, libphp ve tüm bağımlılıkları sıfırdan oluşturulur (önbellek yok)
+* `DEBUG_SYMBOLS`: ayarlandığında, hata ayıklama sembolleri ayıklanmayacak ve binary dosyaya eklenecektir
+* `RELEASE`: (yalnızca bakımcılar) ayarlandığında, ortaya çıkan binary dosya GitHub'a yüklenecektir

docs/tr/worker.md

@@ -0,0 +1,121 @@
+# FrankenPHP Worker'ları Kullanma
+
+Uygulamanızı bir kez önyükleyin ve bellekte tutun.
+FrankenPHP gelen istekleri birkaç milisaniye içinde halledecektir.
+
+## Çalışan Komut Dosyalarının Başlatılması
+
+### Docker
+
+`FRANKENPHP_CONFIG` ortam değişkeninin değerini `worker /path/to/your/worker/script.php` olarak ayarlayın:
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker /app/path/to/your/worker/script.php" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+### Binary Çıktısı
+
+Geçerli dizinin içeriğini bir worker kullanarak sunmak için `php-server` komutunun `--worker` seçeneğini kullanın:
+
+```console
+./frankenphp php-server --worker /path/to/your/worker/script.php
+```
+
+PHP uygulamanız [binary dosyaya gömülü](embed.md) ise, uygulamanın kök dizinine özel bir `Caddyfile` ekleyebilirsiniz.
+Otomatik olarak kullanılacaktır.
+
+## Symfony Çalışma Zamanı
+
+FrankenPHP'nin worker modu [Symfony Runtime Component](https://symfony.com/doc/current/components/runtime.html) tarafından desteklenmektedir.
+Herhangi bir Symfony uygulamasını bir worker'da başlatmak için [PHP Runtime](https://github.com/php-runtime/runtime)'ın FrankenPHP paketini yükleyin:
+
+```console
+composer require runtime/frankenphp-symfony
+```
+
+FrankenPHP Symfony Runtime'ı kullanmak için `APP_RUNTIME` ortam değişkenini tanımlayarak uygulama sunucunuzu başlatın:
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php" \
+    -e APP_RUNTIME=Runtime\\FrankenPhpSymfony\\Runtime \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+## Laravel Octane
+
+Bkz. [ilgili doküman](laravel.md#laravel-octane).
+
+## Özel Uygulamalar
+
+Aşağıdaki örnek, üçüncü taraf bir kütüphaneye güvenmeden kendi çalışan kodunuzu nasıl oluşturacağınızı göstermektedir:
+
+```php
+<?php
+// public/index.php
+
+// Bir istemci bağlantısı kesildiğinde alt komut dosyasının sonlandırılmasını önleyin
+ignore_user_abort(true);
+
+// Uygulamanızı önyükleyin
+require __DIR__.'/vendor/autoload.php';
+
+$myApp = new \App\Kernel();
+$myApp->boot();
+
+// Daha iyi performans için döngü dışında işleyici (daha az iş yapıyor)
+$handler = static function () use ($myApp) {
+    // Bir istek alındığında çağrılır,
+    // superglobals, php://input ve benzerleri sıfırlanır
+    echo $myApp->handle($_GET, $_POST, $_COOKIE, $_FILES, $_SERVER);
+};
+
+for ($nbRequests = 0, $running = true; isset($_SERVER['MAX_REQUESTS']) && ($nbRequests < ((int)$_SERVER['MAX_REQUESTS'])) && $running; ++$nbRequests) {
+    $running = \frankenphp_handle_request($handler);
+
+    // HTTP yanıtını gönderdikten sonra bir şey yapın
+    $myApp->terminate();
+
+    // Bir sayfa oluşturmanın ortasında tetiklenme olasılığını azaltmak için çöp toplayıcıyı çağırın
+    gc_collect_cycles();
+}
+
+// Temizleme
+$myApp->shutdown();
+```
+
+Ardından, uygulamanızı başlatın ve çalışanınızı yapılandırmak için `FRANKENPHP_CONFIG` ortam değişkenini kullanın:
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+Varsayılan olarak, CPU başına 2 worker başlatılır.
+Başlatılacak worker sayısını da yapılandırabilirsiniz:
+
+```console
+docker run \
+    -e FRANKENPHP_CONFIG="worker ./public/index.php 42" \
+    -v $PWD:/app \
+    -p 80:80 -p 443:443 -p 443:443/udp \
+    dunglas/frankenphp
+```
+
+### Belirli Sayıda İstekten Sonra Worker'ı Yeniden Başlatın
+
+<!-- textlint-disable -->
+PHP başlangıçta uzun süreli işlemler için tasarlanmadığından, hala bellek sızdıran birçok kütüphane ve eski kod vardır.
+<!-- textlint-enable -->
+Bu tür kodları worker modunda kullanmak için geçici bir çözüm, belirli sayıda isteği işledikten sonra worker betiğini yeniden başlatmaktır:
+
+Önceki worker kod parçacığı, `MAX_REQUESTS` adlı bir ortam değişkeni ayarlayarak işlenecek maksimum istek sayısını yapılandırmaya izin verir.

docs/worker.md

@@ -25,6 +25,9 @@ Use the `--worker` option of the `php-server` command to serve the content of th
 ./frankenphp php-server --worker /path/to/your/worker/script.php
 ```
 
+If your PHP app is [embeded in the binary](embed.md), you can add a custom `Caddyfile` in the root directory of the app.
+It will be used automatically.
+
 ## Symfony Runtime
 
 The worker mode of FrankenPHP is supported by the [Symfony Runtime Component](https://symfony.com/doc/current/components/runtime.html).
@@ -68,19 +71,24 @@ $myApp->boot();
 
 // Handler outside the loop for better performance (doing less work)
 $handler = static function () use ($myApp) {
-        // Called when a request is received,
-        // superglobals, php://input and the like are reset
-        echo $myApp->handle($_GET, $_POST, $_COOKIE, $_FILES, $_SERVER);
+    // Called when a request is received,
+    // superglobals, php://input and the like are reset
+    echo $myApp->handle($_GET, $_POST, $_COOKIE, $_FILES, $_SERVER);
 };
-for($nbRequests = 0, $running = true; isset($_SERVER['MAX_REQUESTS']) && ($nbRequests < ((int)$_SERVER['MAX_REQUESTS'])) && $running; ++$nbRequests) {
-    $running = \frankenphp_handle_request($handler);
+
+$maxRequests = (int)($_SERVER['MAX_REQUESTS'] ?? 0);
+for ($nbRequests = 0; !$maxRequests || $nbRequests < $maxRequests; ++$nbRequests) {
+    $keepRunning = \frankenphp_handle_request($handler);
 
     // Do something after sending the HTTP response
     $myApp->terminate();
 
     // Call the garbage collector to reduce the chances of it being triggered in the middle of a page generation
     gc_collect_cycles();
+
+    if (!$keepRunning) break;
 }
+
 // Cleanup
 $myApp->shutdown();
 ```
@@ -95,7 +103,7 @@ docker run \
     dunglas/frankenphp
 ```
 
-By default, one worker per CPU is started.
+By default, 2 workers per CPU are started.
 You can also configure the number of workers to start:
 
 ```console
@@ -112,3 +120,26 @@ As PHP was not originally designed for long-running processes, there are still m
 A workaround to using this type of code in worker mode is to restart the worker script after processing a certain number of requests:
 
 The previous worker snippet allows configuring a maximum number of request to handle by setting an environment variable named `MAX_REQUESTS`.
+
+## Superglobals Behavior
+
+[PHP superglobals](https://www.php.net/manual/en/language.variables.superglobals.php) (`$_SERVER`, `$_ENV`, `$_GET`...)
+behave as follows:
+
+* before the first call to `frankenphp_handle_request()`, superglobals contain values bound to the worker script itself
+* during and after the call to `frankenphp_handle_request()`, superglobals contain values generated from the processed HTTP request, each call to `frankenphp_handle_request()` changes the superglobals values
+
+To access the superglobals of the worker script inside the callback, you must copy them and import the copy in the scope of the callback:
+
+```php
+<?php
+// Copy worker's $_SERVER superglobal before the first call to frankenphp_handle_request()
+$workerServer = $_SERVER;
+
+$handler = static function () use ($workerServer) {
+    var_dump($_SERVER); // Request-bound $_SERVER
+    var_dump($workerServer); // $_SERVER of the worker script
+};
+
+// ...
+```

embed.go

@@ -32,7 +32,7 @@ func init() {
 		return
 	}
 
-	appPath := filepath.Join(os.TempDir(), "frankenphp_"+strings.TrimSuffix(string(embeddedAppChecksum[:]), "\n"))
+	appPath := filepath.Join(os.TempDir(), "frankenphp_"+string(embeddedAppChecksum))
 
 	if _, err := os.Stat(appPath); os.IsNotExist(err) {
 		if err := untar(appPath); err != nil {

frankenphp.c

@@ -6,19 +6,23 @@
 #include <errno.h>
 #include <ext/spl/spl_exceptions.h>
 #include <ext/standard/head.h>
+#include <inttypes.h>
 #include <php.h>
 #include <php_config.h>
 #include <php_main.h>
 #include <php_output.h>
 #include <php_variables.h>
 #include <sapi/embed/php_embed.h>
+#include <signal.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
-
-#include "C-Thread-Pool/thpool.c"
-#include "C-Thread-Pool/thpool.h"
+#if defined(__linux__)
+#include <sys/prctl.h>
+#elif defined(__FreeBSD__) || defined(__OpenBSD__)
+#include <pthread_np.h>
+#endif
 
 #include "_cgo_export.h"
 #include "frankenphp_arginfo.h"
@@ -27,8 +31,8 @@
 ZEND_TSRMLS_CACHE_DEFINE()
 #endif
 
-/* Timeouts are currently fundamentally broken with ZTS except on Linux:
- * https://bugs.php.net/bug.php?id=79464 */
+/* Timeouts are currently fundamentally broken with ZTS except on Linux and
+ * FreeBSD: https://bugs.php.net/bug.php?id=79464 */
 #ifndef ZEND_MAX_EXECUTION_TIMERS
 static const char HARDCODED_INI[] = "max_execution_time=0\n"
                                     "max_input_time=-1\n\0";
@@ -72,11 +76,13 @@ typedef struct frankenphp_server_context {
   bool finished;
 } frankenphp_server_context;
 
-static uintptr_t frankenphp_clean_server_context() {
+__thread frankenphp_server_context *local_ctx = NULL;
+
+static void frankenphp_free_request_context() {
   frankenphp_server_context *ctx = SG(server_context);
-  if (ctx == NULL) {
-    return 0;
-  }
+
+  free(ctx->cookie_data);
+  ctx->cookie_data = NULL;
 
   free(SG(request_info).auth_password);
   SG(request_info).auth_password = NULL;
@@ -98,19 +104,13 @@ static uintptr_t frankenphp_clean_server_context() {
 
   free(SG(request_info).request_uri);
   SG(request_info).request_uri = NULL;
-
-  return ctx->current_request;
 }
 
-static void frankenphp_request_reset() {
+static void frankenphp_destroy_super_globals() {
   zend_try {
-    int i;
-
-    for (i = 0; i < NUM_TRACK_VARS; i++) {
-      zval_ptr_dtor(&PG(http_globals)[i]);
+    for (int i = 0; i < NUM_TRACK_VARS; i++) {
+      zval_ptr_dtor_nogc(&PG(http_globals)[i]);
     }
-
-    memset(&PG(http_globals), 0, sizeof(zval) * NUM_TRACK_VARS);
   }
   zend_end_try();
 }
@@ -121,7 +121,7 @@ static void frankenphp_worker_request_shutdown() {
   zend_try { php_output_end_all(); }
   zend_end_try();
 
-  // TODO: store the list of modules to reload in a global module variable
+  /* TODO: store the list of modules to reload in a global module variable */
   const char **module_name;
   zend_module_entry *module;
   for (module_name = MODULES_TO_RELOAD; *module_name; module_name++) {
@@ -136,15 +136,15 @@ static void frankenphp_worker_request_shutdown() {
   zend_try { php_output_deactivate(); }
   zend_end_try();
 
-  /* Clean super globals */
-  frankenphp_request_reset();
-
   /* SAPI related shutdown (free stuff) */
-  frankenphp_clean_server_context();
+  frankenphp_free_request_context();
   zend_try { sapi_deactivate(); }
   zend_end_try();
 
   zend_set_memory_limit(PG(memory_limit));
+  /* TODO: remove next line when https://github.com/php/php-src/pull/14499 will
+   * be available */
+  SG(rfc1867_uploaded_files) = NULL;
 }
 
 /* Adapted from php_request_startup() */
@@ -152,6 +152,7 @@ static int frankenphp_worker_request_startup() {
   int retval = SUCCESS;
 
   zend_try {
+    frankenphp_destroy_super_globals();
     php_output_activate();
 
     /* initialize global variables */
@@ -161,16 +162,13 @@ static int frankenphp_worker_request_startup() {
     /* Keep the current execution context */
     sapi_activate();
 
-    /*
-     * Timeouts are currently fundamentally broken with ZTS:
-     *https://bugs.php.net/bug.php?id=79464
-     *
-     *if (PG(max_input_time) == -1) {
-     *	zend_set_timeout(EG(timeout_seconds), 1);
-     *} else {
-     *	zend_set_timeout(PG(max_input_time), 1);
-     *}
-     */
+#ifdef ZEND_MAX_EXECUTION_TIMERS
+    if (PG(max_input_time) == -1) {
+      zend_set_timeout(EG(timeout_seconds), 1);
+    } else {
+      zend_set_timeout(PG(max_input_time), 1);
+    }
+#endif
 
     if (PG(expose_php)) {
       sapi_add_header(SAPI_PHP_VERSION_HEADER,
@@ -195,11 +193,11 @@ static int frankenphp_worker_request_startup() {
 
     zend_is_auto_global(ZSTR_KNOWN(ZEND_STR_AUTOGLOBAL_SERVER));
 
-    // unfinish the request
+    /* Unfinish the request */
     frankenphp_server_context *ctx = SG(server_context);
     ctx->finished = false;
 
-    // TODO: store the list of modules to reload in a global module variable
+    /* TODO: store the list of modules to reload in a global module variable */
     const char **module_name;
     zend_module_entry *module;
     for (module_name = MODULES_TO_RELOAD; *module_name; module_name++) {
@@ -243,14 +241,14 @@ PHP_FUNCTION(frankenphp_finish_request) { /* {{{ */
 } /* }}} */
 
 /* {{{ Fetch all HTTP request headers */
-PHP_FUNCTION(apache_request_headers) {
+PHP_FUNCTION(frankenphp_request_headers) {
   if (zend_parse_parameters_none() == FAILURE) {
     RETURN_THROWS();
   }
 
   frankenphp_server_context *ctx = SG(server_context);
   struct go_apache_request_headers_return headers =
-      go_apache_request_headers(ctx->current_request);
+      go_apache_request_headers(ctx->current_request, ctx->main_request);
 
   array_init_size(return_value, headers.r1);
 
@@ -261,7 +259,60 @@ PHP_FUNCTION(apache_request_headers) {
     add_assoc_stringl_ex(return_value, key.data, key.len, val.data, val.len);
   }
 
-  free(headers.r0);
+  go_apache_request_cleanup(headers.r2);
+}
+/* }}} */
+
+/* add_response_header and apache_response_headers are copied from
+ * https://github.com/php/php-src/blob/master/sapi/cli/php_cli_server.c
+ * Copyright (c) The PHP Group
+ * Licensed under The PHP License
+ * Original authors: Moriyoshi Koizumi <moriyoshi@php.net> and Xinchen Hui
+ * <laruence@php.net>
+ */
+static void add_response_header(sapi_header_struct *h,
+                                zval *return_value) /* {{{ */
+{
+  if (h->header_len > 0) {
+    char *s;
+    size_t len = 0;
+    ALLOCA_FLAG(use_heap)
+
+    char *p = strchr(h->header, ':');
+    if (NULL != p) {
+      len = p - h->header;
+    }
+    if (len > 0) {
+      while (len != 0 &&
+             (h->header[len - 1] == ' ' || h->header[len - 1] == '\t')) {
+        len--;
+      }
+      if (len) {
+        s = do_alloca(len + 1, use_heap);
+        memcpy(s, h->header, len);
+        s[len] = 0;
+        do {
+          p++;
+        } while (*p == ' ' || *p == '\t');
+        add_assoc_stringl_ex(return_value, s, len, p,
+                             h->header_len - (p - h->header));
+        free_alloca(s, use_heap);
+      }
+    }
+  }
+}
+/* }}} */
+
+PHP_FUNCTION(frankenphp_response_headers) /* {{{ */
+{
+  if (zend_parse_parameters_none() == FAILURE) {
+    RETURN_THROWS();
+  }
+
+  array_init(return_value);
+  zend_llist_apply_with_argument(
+      &SG(sapi_headers).headers,
+      (llist_apply_with_arg_func_t)add_response_header, return_value);
 }
 /* }}} */
 
@@ -276,7 +327,7 @@ PHP_FUNCTION(frankenphp_handle_request) {
   frankenphp_server_context *ctx = SG(server_context);
 
   if (ctx->main_request == 0) {
-    // not a worker, throw an error
+    /* not a worker, throw an error */
     zend_throw_exception(
         spl_ce_RuntimeException,
         "frankenphp_handle_request() called while not in worker mode", 0);
@@ -294,7 +345,7 @@ PHP_FUNCTION(frankenphp_handle_request) {
   }
 
 #ifdef ZEND_MAX_EXECUTION_TIMERS
-  // Disable timeouts while waiting for a request to handle
+  /* Disable timeouts while waiting for a request to handle */
   zend_unset_timeout();
 #endif
 
@@ -307,9 +358,12 @@ PHP_FUNCTION(frankenphp_handle_request) {
   }
 
 #ifdef ZEND_MAX_EXECUTION_TIMERS
-  // Reset default timeout
-  // TODO: add support for max_input_time
-  zend_set_timeout(INI_INT("max_execution_time"), 0);
+  /*
+   * Reset default timeout
+   */
+  if (PG(max_input_time) != -1) {
+    zend_set_timeout(INI_INT("max_execution_time"), 0);
+  }
 #endif
 
   /* Call the PHP func */
@@ -320,8 +374,10 @@ PHP_FUNCTION(frankenphp_handle_request) {
     zval_ptr_dtor(&retval);
   }
 
-  /* If an exception occured, print the message to the client before closing the
-   * connection */
+  /*
+   * If an exception occured, print the message to the client before closing the
+   * connection
+   */
   if (EG(exception)) {
     zend_exception_error(EG(exception), E_ERROR);
   }
@@ -366,27 +422,17 @@ static zend_module_entry frankenphp_module = {
     TOSTRING(FRANKENPHP_VERSION),
     STANDARD_MODULE_PROPERTIES};
 
-static uintptr_t frankenphp_request_shutdown() {
+static void frankenphp_request_shutdown() {
   frankenphp_server_context *ctx = SG(server_context);
 
   if (ctx->main_request && ctx->current_request) {
-    frankenphp_request_reset();
+    frankenphp_destroy_super_globals();
   }
 
   php_request_shutdown((void *)0);
+  frankenphp_free_request_context();
 
-  free(ctx->cookie_data);
-  ((frankenphp_server_context *)SG(server_context))->cookie_data = NULL;
-  uintptr_t rh = frankenphp_clean_server_context();
-
-  free(ctx);
-  SG(server_context) = NULL;
-
-#if defined(ZTS)
-  ts_free_thread();
-#endif
-
-  return rh;
+  memset(local_ctx, 0, sizeof(frankenphp_server_context));
 }
 
 int frankenphp_update_server_context(
@@ -398,21 +444,9 @@ int frankenphp_update_server_context(
   frankenphp_server_context *ctx;
 
   if (create) {
-#ifdef ZTS
-    /* initial resource fetch */
-    (void)ts_resource(0);
-#ifdef PHP_WIN32
-    ZEND_TSRMLS_CACHE_UPDATE();
-#endif
-#endif
-
-    /* todo: use a pool */
-    ctx = (frankenphp_server_context *)calloc(
-        1, sizeof(frankenphp_server_context));
-    if (ctx == NULL) {
-      return FAILURE;
-    }
+    ctx = local_ctx;
 
+    ctx->worker_ready = false;
     ctx->cookie_data = NULL;
     ctx->finished = false;
 
@@ -421,6 +455,9 @@ int frankenphp_update_server_context(
     ctx = (frankenphp_server_context *)SG(server_context);
   }
 
+  // It is not reset by zend engine, set it to 200.
+  SG(sapi_headers).http_response_code = 200;
+
   ctx->main_request = main_request;
   ctx->current_request = current_request;
 
@@ -450,7 +487,8 @@ static size_t frankenphp_ub_write(const char *str, size_t str_length) {
   frankenphp_server_context *ctx = SG(server_context);
 
   if (ctx->finished) {
-    // TODO: maybe log a warning that we tried to write to a finished request?
+    /* TODO: maybe log a warning that we tried to write to a finished request?
+     */
     return 0;
   }
 
@@ -520,8 +558,23 @@ static char *frankenphp_read_cookies(void) {
   return ctx->cookie_data;
 }
 
-static void frankenphp_register_known_variable(const char *key, char *value,
-                                               zval *track_vars_array, bool f) {
+static void frankenphp_register_known_variable(const char *key, go_string value,
+                                               zval *track_vars_array) {
+  if (value.data == NULL) {
+    php_register_variable_safe(key, "", 0, track_vars_array);
+    return;
+  }
+
+  size_t new_val_len;
+  if (sapi_module.input_filter(PARSE_SERVER, key, &value.data, value.len,
+                               &new_val_len)) {
+    php_register_variable_safe(key, value.data, new_val_len, track_vars_array);
+  }
+}
+
+static void
+frankenphp_register_variable_from_request_info(const char *key, char *value,
+                                               zval *track_vars_array) {
   if (value == NULL) {
     return;
   }
@@ -531,91 +584,80 @@ static void frankenphp_register_known_variable(const char *key, char *value,
                                &new_val_len)) {
     php_register_variable_safe(key, value, new_val_len, track_vars_array);
   }
-
-  if (f) {
-    free(value);
-    value = NULL;
-  }
 }
 
-void frankenphp_register_bulk_variables(char *known_variables[27],
-                                        char **dynamic_variables, size_t size,
-                                        zval *track_vars_array) {
+void frankenphp_register_bulk_variables(go_string known_variables[27],
+                                        php_variable *dynamic_variables,
+                                        size_t size, zval *track_vars_array) {
   /* Not used, but must be present */
-  frankenphp_register_known_variable("AUTH_TYPE", "", track_vars_array, false);
-  frankenphp_register_known_variable("REMOTE_IDENT", "", track_vars_array,
-                                     false);
+  php_register_variable_safe("AUTH_TYPE", "", 0, track_vars_array);
+  php_register_variable_safe("REMOTE_IDENT", "", 0, track_vars_array);
 
   /* Allocated in frankenphp_update_server_context() */
-  frankenphp_register_known_variable("CONTENT_TYPE",
-                                     (char *)SG(request_info).content_type,
-                                     track_vars_array, false);
-  frankenphp_register_known_variable("PATH_TRANSLATED",
-                                     (char *)SG(request_info).path_translated,
-                                     track_vars_array, false);
-  frankenphp_register_known_variable(
-      "QUERY_STRING", SG(request_info).query_string, track_vars_array, false);
-  frankenphp_register_known_variable("REMOTE_USER",
-                                     (char *)SG(request_info).auth_user,
-                                     track_vars_array, false);
-  frankenphp_register_known_variable("REQUEST_METHOD",
-                                     (char *)SG(request_info).request_method,
-                                     track_vars_array, false);
-  frankenphp_register_known_variable(
-      "REQUEST_URI", SG(request_info).request_uri, track_vars_array, false);
+  frankenphp_register_variable_from_request_info(
+      "CONTENT_TYPE", (char *)SG(request_info).content_type, track_vars_array);
+  frankenphp_register_variable_from_request_info(
+      "PATH_TRANSLATED", (char *)SG(request_info).path_translated,
+      track_vars_array);
+  frankenphp_register_variable_from_request_info(
+      "QUERY_STRING", SG(request_info).query_string, track_vars_array);
+  frankenphp_register_variable_from_request_info(
+      "REMOTE_USER", (char *)SG(request_info).auth_user, track_vars_array);
+  frankenphp_register_variable_from_request_info(
+      "REQUEST_METHOD", (char *)SG(request_info).request_method,
+      track_vars_array);
+  frankenphp_register_variable_from_request_info(
+      "REQUEST_URI", SG(request_info).request_uri, track_vars_array);
 
   /* Known variables */
   frankenphp_register_known_variable("CONTENT_LENGTH", known_variables[0],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("DOCUMENT_ROOT", known_variables[1],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("DOCUMENT_URI", known_variables[2],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("GATEWAY_INTERFACE", known_variables[3],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("HTTP_HOST", known_variables[4],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("HTTPS", known_variables[5],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("PATH_INFO", known_variables[6],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("PHP_SELF", known_variables[7],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("REMOTE_ADDR", known_variables[8],
-                                     track_vars_array,
-                                     known_variables[8] != known_variables[9]);
+                                     track_vars_array);
   frankenphp_register_known_variable("REMOTE_HOST", known_variables[9],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("REMOTE_PORT", known_variables[10],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("REQUEST_SCHEME", known_variables[11],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("SCRIPT_FILENAME", known_variables[12],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("SCRIPT_NAME", known_variables[13],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("SERVER_NAME", known_variables[14],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("SERVER_PORT", known_variables[15],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("SERVER_PROTOCOL", known_variables[16],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("SERVER_SOFTWARE", known_variables[17],
-                                     track_vars_array, true);
+                                     track_vars_array);
   frankenphp_register_known_variable("SSL_PROTOCOL", known_variables[18],
-                                     track_vars_array, true);
+                                     track_vars_array);
 
   size_t new_val_len;
-  for (size_t i = 0; i < size; i = i + 2) {
-    if (sapi_module.input_filter(
-            PARSE_SERVER, dynamic_variables[i], &dynamic_variables[i + 1],
-            strlen(dynamic_variables[i + 1]), &new_val_len)) {
-      php_register_variable_safe(dynamic_variables[i], dynamic_variables[i + 1],
-                                 new_val_len, track_vars_array);
+  for (size_t i = 0; i < size; i++) {
+    if (sapi_module.input_filter(PARSE_SERVER, dynamic_variables[i].var,
+                                 &dynamic_variables[i].data,
+                                 dynamic_variables[i].data_len, &new_val_len)) {
+      php_register_variable_safe(dynamic_variables[i].var,
+                                 dynamic_variables[i].data, new_val_len,
+                                 track_vars_array);
     }
-
-    free(dynamic_variables[i]);
-    free(dynamic_variables[i + 1]);
   }
 }
 
@@ -623,6 +665,11 @@ static void frankenphp_register_variables(zval *track_vars_array) {
   /* https://www.php.net/manual/en/reserved.variables.server.php */
   frankenphp_server_context *ctx = SG(server_context);
 
+  /* In CGI mode, we consider the environment to be a part of the server
+   * variables
+   */
+  php_import_environment_variables(track_vars_array);
+
   go_register_variables(ctx->current_request ? ctx->current_request
                                              : ctx->main_request,
                         track_vars_array);
@@ -663,10 +710,73 @@ sapi_module_struct frankenphp_sapi_module = {
 
     STANDARD_SAPI_MODULE_PROPERTIES};
 
-static void *manager_thread(void *arg) {
+/* Sets thread name for profiling and debugging.
+ *
+ * Adapted from https://github.com/Pithikos/C-Thread-Pool
+ * Copyright: Johan Hanssen Seferidis
+ * License: MIT
+ */
+static void set_thread_name(char *thread_name) {
+#if defined(__linux__)
+  /* Use prctl instead to prevent using _GNU_SOURCE flag and implicit
+   * declaration */
+  prctl(PR_SET_NAME, thread_name);
+#elif defined(__APPLE__) && defined(__MACH__)
+  pthread_setname_np(thread_name);
+#elif defined(__FreeBSD__) || defined(__OpenBSD__)
+  pthread_set_name_np(pthread_self(), thread_name);
+#endif
+}
+
+static void *php_thread(void *arg) {
+  char thread_name[16] = {0};
+  snprintf(thread_name, 16, "php-%" PRIxPTR, (uintptr_t)arg);
+  set_thread_name(thread_name);
+
 #ifdef ZTS
-  // TODO: use tsrm_startup() directly as we know the number of expected threads
+  /* initial resource fetch */
+  (void)ts_resource(0);
+#ifdef PHP_WIN32
+  ZEND_TSRMLS_CACHE_UPDATE();
+#endif
+#endif
+
+  local_ctx = malloc(sizeof(frankenphp_server_context));
+
+  while (go_handle_request()) {
+  }
+
+#ifdef ZTS
+  ts_free_thread();
+#endif
+
+  return NULL;
+}
+
+static void *php_main(void *arg) {
+  /*
+   * SIGPIPE must be masked in non-Go threads:
+   * https://pkg.go.dev/os/signal#hdr-Go_programs_that_use_cgo_or_SWIG
+   */
+  sigset_t set;
+  sigemptyset(&set);
+  sigaddset(&set, SIGPIPE);
+
+  if (pthread_sigmask(SIG_BLOCK, &set, NULL) != 0) {
+    perror("failed to block SIGPIPE");
+    exit(EXIT_FAILURE);
+  }
+
+  intptr_t num_threads = (intptr_t)arg;
+
+  set_thread_name("php-main");
+
+#ifdef ZTS
+#if (PHP_VERSION_ID >= 80300)
+  php_tsrm_startup_ex(num_threads);
+#else
   php_tsrm_startup();
+#endif
   /*tsrm_error_set(TSRM_ERROR_LEVEL_INFO, NULL);*/
 #ifdef PHP_WIN32
   ZEND_TSRMLS_CACHE_UPDATE();
@@ -680,6 +790,10 @@ static void *manager_thread(void *arg) {
   frankenphp_sapi_module.ini_entries = HARDCODED_INI;
 #else
   frankenphp_sapi_module.ini_entries = malloc(sizeof(HARDCODED_INI));
+  if (frankenphp_sapi_module.ini_entries == NULL) {
+    perror("malloc failed");
+    exit(EXIT_FAILURE);
+  }
   memcpy(frankenphp_sapi_module.ini_entries, HARDCODED_INI,
          sizeof(HARDCODED_INI));
 #endif
@@ -687,18 +801,30 @@ static void *manager_thread(void *arg) {
 
   frankenphp_sapi_module.startup(&frankenphp_sapi_module);
 
-  threadpool thpool = thpool_init(*((int *)arg));
-  free(arg);
-
-  uintptr_t rh;
-  while ((rh = go_fetch_request())) {
-    thpool_add_work(thpool, go_execute_script, (void *)rh);
+  pthread_t *threads = malloc(num_threads * sizeof(pthread_t));
+  if (threads == NULL) {
+    perror("malloc failed");
+    exit(EXIT_FAILURE);
   }
 
-  /* channel closed, shutdown gracefully */
-  thpool_wait(thpool);
-  thpool_destroy(thpool);
+  for (uintptr_t i = 0; i < num_threads; i++) {
+    if (pthread_create(&(*(threads + i)), NULL, &php_thread, (void *)i) != 0) {
+      perror("failed to create PHP thread");
+      free(threads);
+      exit(EXIT_FAILURE);
+    }
+  }
 
+  for (int i = 0; i < num_threads; i++) {
+    if (pthread_join((*(threads + i)), NULL) != 0) {
+      perror("failed to join PHP thread");
+      free(threads);
+      exit(EXIT_FAILURE);
+    }
+  }
+  free(threads);
+
+  /* channel closed, shutdown gracefully */
   frankenphp_sapi_module.shutdown(&frankenphp_sapi_module);
 
   sapi_shutdown();
@@ -721,10 +847,7 @@ static void *manager_thread(void *arg) {
 int frankenphp_init(int num_threads) {
   pthread_t thread;
 
-  int *num_threads_ptr = calloc(1, sizeof(int));
-  *num_threads_ptr = num_threads;
-
-  if (pthread_create(&thread, NULL, *manager_thread, (void *)num_threads_ptr) !=
+  if (pthread_create(&thread, NULL, &php_main, (void *)(intptr_t)num_threads) !=
       0) {
     go_shutdown();
 
@@ -739,10 +862,6 @@ int frankenphp_request_startup() {
     return SUCCESS;
   }
 
-  frankenphp_server_context *ctx = SG(server_context);
-  SG(server_context) = NULL;
-  free(ctx);
-
   php_request_shutdown((void *)0);
 
   return FAILURE;
@@ -751,6 +870,7 @@ int frankenphp_request_startup() {
 int frankenphp_execute_script(char *file_name) {
   if (frankenphp_request_startup() == FAILURE) {
     free(file_name);
+    file_name = NULL;
 
     return FAILURE;
   }
@@ -760,6 +880,7 @@ int frankenphp_execute_script(char *file_name) {
   zend_file_handle file_handle;
   zend_stream_init_filename(&file_handle, file_name);
   free(file_name);
+  file_name = NULL;
 
   file_handle.primary_script = 1;
 
@@ -773,19 +894,25 @@ int frankenphp_execute_script(char *file_name) {
 
   zend_destroy_file_handle(&file_handle);
 
-  frankenphp_clean_server_context();
+  frankenphp_free_request_context();
   frankenphp_request_shutdown();
 
   return status;
 }
 
-// Use global variables to store CLI arguments to prevent useless allocations
+/* Use global variables to store CLI arguments to prevent useless allocations */
 static char *cli_script;
 static int cli_argc;
 static char **cli_argv;
 
-// Adapted from https://github.com/php/php-src/sapi/cli/php_cli.c (The PHP
-// Group, The PHP License)
+/*
+ * CLI code is adapted from
+ * https://github.com/php/php-src/blob/master/sapi/cli/php_cli.c Copyright (c)
+ * The PHP Group Licensed under The PHP License Original uthors: Edin Kadribasic
+ * <edink@php.net>, Marcus Boerger <helly@php.net> and Johannes Schlueter
+ * <johannes@php.net> Parts based on CGI SAPI Module by Rasmus Lerdorf, Stig
+ * Bakken and Zeev Suraski
+ */
 static void cli_register_file_handles(bool no_close) /* {{{ */
 {
   php_stream *s_in, *s_out, *s_err;
@@ -812,7 +939,7 @@ static void cli_register_file_handles(bool no_close) /* {{{ */
     s_err->flags |= PHP_STREAM_FLAG_NO_CLOSE;
   }
 
-  // s_in_process = s_in;
+  /*s_in_process = s_in;*/
 
   php_stream_to_zval(s_in, &ic.value);
   php_stream_to_zval(s_out, &oc.value);
@@ -837,7 +964,8 @@ static void sapi_cli_register_variables(zval *track_vars_array) /* {{{ */
   size_t len;
   char *docroot = "";
 
-  /* In CGI mode, we consider the environment to be a part of the server
+  /*
+   * In CGI mode, we consider the environment to be a part of the server
    * variables
    */
   php_import_environment_variables(track_vars_array);
@@ -876,7 +1004,9 @@ static void sapi_cli_register_variables(zval *track_vars_array) /* {{{ */
 static void *execute_script_cli(void *arg) {
   void *exit_status;
 
-  // The SAPI name "cli" is hardcoded into too many programs... let's usurp it.
+  /*
+   * The SAPI name "cli" is hardcoded into too many programs... let's usurp it.
+   */
   php_embed_module.name = "cli";
   php_embed_module.pretty_name = "PHP CLI embedded in FrankenPHP";
   php_embed_module.register_server_variables = sapi_cli_register_variables;
@@ -909,8 +1039,10 @@ int frankenphp_execute_script_cli(char *script, int argc, char **argv) {
   cli_argc = argc;
   cli_argv = argv;
 
-  // Start the script in a dedicated thread to prevent conflicts between Go and
-  // PHP signal handlers
+  /*
+   * Start the script in a dedicated thread to prevent conflicts between Go and
+   * PHP signal handlers
+   */
   err = pthread_create(&thread, NULL, execute_script_cli, NULL);
   if (err != 0) {
     return err;

frankenphp.go

@@ -5,10 +5,6 @@
 // [FrankenPHP app server]: https://frankenphp.dev
 package frankenphp
 
-//go:generate rm -Rf C-Thread-Pool/
-//go:generate git clone --depth=1 git@github.com:Pithikos/C-Thread-Pool.git
-//go:generate rm -Rf C-Thread-Pool/.git C-Thread-Pool/.github C-Thread-Pool/docs C-Thread-Pool/tests C-Thread-Pool/example.c
-
 // Use PHP includes corresponding to your PHP installation by running:
 //
 //   export CGO_CFLAGS=$(php-config --includes)
@@ -17,14 +13,12 @@ package frankenphp
 // We also set these flags for hardening: https://github.com/docker-library/php/blob/master/8.2/bookworm/zts/Dockerfile#L57-L59
 
 // #cgo darwin pkg-config: libxml-2.0
-// #cgo CFLAGS: -Wall -Werror -fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
+// #cgo CFLAGS: -Wall -Werror
 // #cgo CFLAGS: -I/usr/local/include/php -I/usr/local/include/php/main -I/usr/local/include/php/TSRM -I/usr/local/include/php/Zend -I/usr/local/include/php/ext -I/usr/local/include/php/ext/date/lib
-// #cgo CFLAGS: -DTHREAD_NAME=frankenphp
 // #cgo linux CFLAGS: -D_GNU_SOURCE
-// #cgo CPPFLAGS: -fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
 // #cgo darwin LDFLAGS: -L/opt/homebrew/opt/libiconv/lib -liconv
-// #cgo linux LDFLAGS: -Wl,-O1 -lresolv
-// #cgo LDFLAGS: -pie -L/usr/local/lib -L/usr/lib -lphp -ldl -lm -lutil
+// #cgo linux LDFLAGS: -lresolv
+// #cgo LDFLAGS: -L/usr/local/lib -L/usr/lib -lphp -ldl -lm -lutil
 // #include <stdlib.h>
 // #include <stdint.h>
 // #include <php_variables.h>
@@ -47,7 +41,9 @@ import (
 	"sync"
 	"unsafe"
 
+	"github.com/maypok86/otter"
 	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
 	// debug on Linux
 	//_ "github.com/ianlancetaylor/cgosymbolizer"
 )
@@ -115,7 +111,7 @@ func (l syslogLevel) String() string {
 type FrankenPHPContext struct {
 	documentRoot string
 	splitPath    []string
-	env          map[string]string
+	env          PreparedEnv
 	logger       *zap.Logger
 
 	docURI         string
@@ -324,9 +320,13 @@ func Init(options ...Option) error {
 		return err
 	}
 
-	logger.Info("FrankenPHP started 🐘", zap.String("php_version", Version().Version))
+	if c := logger.Check(zapcore.InfoLevel, "FrankenPHP started 🐘"); c != nil {
+		c.Write(zap.String("php_version", Version().Version), zap.Int("num_threads", opt.numThreads))
+	}
 	if EmbeddedAppPath != "" {
-		logger.Info("embedded PHP app 📦", zap.String("path", EmbeddedAppPath))
+		if c := logger.Check(zapcore.InfoLevel, "embedded PHP app 📦"); c != nil {
+			c.Write(zap.String("path", EmbeddedAppPath))
+		}
 	}
 
 	return nil
@@ -467,16 +467,36 @@ func ServeHTTP(responseWriter http.ResponseWriter, request *http.Request) error
 	return nil
 }
 
-//export go_fetch_request
-func go_fetch_request() C.uintptr_t {
+//export go_handle_request
+func go_handle_request() bool {
 	select {
 	case <-done:
-		return 0
+		return false
 
 	case r := <-requestChan:
 		h := cgo.NewHandle(r)
 		r.Context().Value(handleKey).(*handleList).AddHandle(h)
-		return C.uintptr_t(h)
+
+		fc, ok := FromContext(r.Context())
+		if !ok {
+			panic(InvalidRequestError)
+		}
+		defer func() {
+			maybeCloseContext(fc)
+			r.Context().Value(handleKey).(*handleList).FreeAll()
+		}()
+
+		if err := updateServerContext(r, true, 0); err != nil {
+			panic(err)
+		}
+
+		// scriptFilename is freed in frankenphp_execute_script()
+		fc.exitStatus = C.frankenphp_execute_script(C.CString(fc.scriptFilename))
+		if fc.exitStatus < 0 {
+			panic(ScriptExecutionError)
+		}
+
+		return true
 	}
 }
 
@@ -486,33 +506,6 @@ func maybeCloseContext(fc *FrankenPHPContext) {
 	})
 }
 
-// go_execute_script Note: only called in cgi-mode
-//
-//export go_execute_script
-func go_execute_script(rh unsafe.Pointer) {
-	handle := cgo.Handle(rh)
-
-	request := handle.Value().(*http.Request)
-	fc, ok := FromContext(request.Context())
-	if !ok {
-		panic(InvalidRequestError)
-	}
-	defer func() {
-		maybeCloseContext(fc)
-		request.Context().Value(handleKey).(*handleList).FreeAll()
-	}()
-
-	if err := updateServerContext(request, true, 0); err != nil {
-		panic(err)
-	}
-
-	// scriptFilename is freed in frankenphp_execute_script()
-	fc.exitStatus = C.frankenphp_execute_script(C.CString(fc.scriptFilename))
-	if fc.exitStatus < 0 {
-		panic(ScriptExecutionError)
-	}
-}
-
 //export go_ub_write
 func go_ub_write(rh C.uintptr_t, cBuf *C.char, length C.int) (C.size_t, C.bool) {
 	r := cgo.Handle(rh).Value().(*http.Request)
@@ -529,7 +522,9 @@ func go_ub_write(rh C.uintptr_t, cBuf *C.char, length C.int) (C.size_t, C.bool)
 
 	i, e := writer.Write(unsafe.Slice((*byte)(unsafe.Pointer(cBuf)), length))
 	if e != nil {
-		fc.logger.Error("write error", zap.Error(e))
+		if c := fc.logger.Check(zapcore.ErrorLevel, "write error"); c != nil {
+			c.Write(zap.Error(e))
+		}
 	}
 
 	if fc.responseWriter == nil {
@@ -539,73 +534,144 @@ func go_ub_write(rh C.uintptr_t, cBuf *C.char, length C.int) (C.size_t, C.bool)
 	return C.size_t(i), C.bool(clientHasClosed(r))
 }
 
+// There are around 60 common request headers according to https://en.wikipedia.org/wiki/List_of_HTTP_header_fields#Request_fields
+// Give some space for custom headers
+var headerKeyCache = func() otter.Cache[string, string] {
+	c, err := otter.MustBuilder[string, string](256).Build()
+	if err != nil {
+		panic(err)
+	}
+
+	return c
+}()
+
 //export go_register_variables
 func go_register_variables(rh C.uintptr_t, trackVarsArray *C.zval) {
 	r := cgo.Handle(rh).Value().(*http.Request)
 	fc := r.Context().Value(contextKey).(*FrankenPHPContext)
 
-	le := (len(fc.env) + len(r.Header)) * 2
-	dynamicVariables := make([]*C.char, le)
+	p := &runtime.Pinner{}
+
+	dynamicVariables := make([]C.php_variable, len(fc.env)+len(r.Header))
+
+	var l int
 
-	var i int
 	// Add all HTTP headers to env variables
 	for field, val := range r.Header {
-		k := "HTTP_" + headerNameReplacer.Replace(strings.ToUpper(field))
+		k, ok := headerKeyCache.Get(field)
+		if !ok {
+			k = "HTTP_" + headerNameReplacer.Replace(strings.ToUpper(field)) + "\x00"
+			headerKeyCache.SetIfAbsent(field, k)
+		}
+
 		if _, ok := fc.env[k]; ok {
 			continue
 		}
 
-		dynamicVariables[i] = C.CString(k)
-		i++
+		v := strings.Join(val, ", ")
 
-		dynamicVariables[i] = C.CString(strings.Join(val, ", "))
-		i++
+		kData := unsafe.StringData(k)
+		vData := unsafe.StringData(v)
+
+		p.Pin(kData)
+		p.Pin(vData)
+
+		dynamicVariables[l]._var = (*C.char)(unsafe.Pointer(kData))
+		dynamicVariables[l].data_len = C.size_t(len(v))
+		dynamicVariables[l].data = (*C.char)(unsafe.Pointer(vData))
+
+		l++
 	}
 
 	for k, v := range fc.env {
-		dynamicVariables[i] = C.CString(k)
-		i++
+		if _, ok := knownServerKeys[k]; ok {
+			continue
+		}
 
-		dynamicVariables[i] = C.CString(v)
-		i++
+		kData := unsafe.StringData(k)
+		vData := unsafe.Pointer(unsafe.StringData(v))
+
+		p.Pin(kData)
+		p.Pin(vData)
+
+		dynamicVariables[l]._var = (*C.char)(unsafe.Pointer(kData))
+		dynamicVariables[l].data_len = C.size_t(len(v))
+		dynamicVariables[l].data = (*C.char)(unsafe.Pointer(vData))
+
+		l++
 	}
 
-	var dynamicVariablesPtr **C.char = nil
-	if le > 0 {
-		dynamicVariablesPtr = &dynamicVariables[0]
-	}
+	knownVariables := computeKnownVariables(r, p)
 
-	knownVariables := computeKnownVariables(r)
-	C.frankenphp_register_bulk_variables(&knownVariables[0], dynamicVariablesPtr, C.size_t(le), trackVarsArray)
+	dvsd := unsafe.SliceData(dynamicVariables)
+	p.Pin(dvsd)
+
+	C.frankenphp_register_bulk_variables(&knownVariables[0], dvsd, C.size_t(l), trackVarsArray)
+
+	p.Unpin()
 
 	fc.env = nil
 }
 
 //export go_apache_request_headers
-func go_apache_request_headers(rh C.uintptr_t) (*C.go_string, C.size_t) {
+func go_apache_request_headers(rh, mrh C.uintptr_t) (*C.go_string, C.size_t, C.uintptr_t) {
+	if rh == 0 {
+		// worker mode, not handling a request
+		mr := cgo.Handle(mrh).Value().(*http.Request)
+		mfc := mr.Context().Value(contextKey).(*FrankenPHPContext)
+
+		if c := mfc.logger.Check(zapcore.DebugLevel, "apache_request_headers() called in non-HTTP context"); c != nil {
+			c.Write(zap.String("worker", mfc.scriptFilename))
+		}
+
+		return nil, 0, 0
+	}
 	r := cgo.Handle(rh).Value().(*http.Request)
 
-	rl := len(r.Header)
-	scs := unsafe.Sizeof(C.go_string{})
+	pinner := &runtime.Pinner{}
+	pinnerHandle := C.uintptr_t(cgo.NewHandle(pinner))
+
+	headers := make([]C.go_string, 0, len(r.Header)*2)
 
-	headers := (*C.go_string)(unsafe.Pointer(C.malloc(C.size_t(rl*2) * (C.size_t)(scs))))
-	header := headers
 	for field, val := range r.Header {
-		*header = C.go_string{C.size_t(len(field)), (*C.char)(unsafe.Pointer(unsafe.StringData(field)))}
-		header = (*C.go_string)(unsafe.Add(unsafe.Pointer(header), scs))
+		fd := unsafe.StringData(field)
+		pinner.Pin(fd)
 
 		cv := strings.Join(val, ", ")
-		*header = C.go_string{C.size_t(len(cv)), (*C.char)(unsafe.Pointer(unsafe.StringData(cv)))}
-		header = (*C.go_string)(unsafe.Add(unsafe.Pointer(header), scs))
+		vd := unsafe.StringData(cv)
+		pinner.Pin(vd)
+
+		headers = append(
+			headers,
+			C.go_string{C.size_t(len(field)), (*C.char)(unsafe.Pointer(fd))},
+			C.go_string{C.size_t(len(cv)), (*C.char)(unsafe.Pointer(vd))},
+		)
 	}
 
-	return headers, C.size_t(rl)
+	sd := unsafe.SliceData(headers)
+	pinner.Pin(sd)
+
+	return sd, C.size_t(len(r.Header)), pinnerHandle
+}
+
+//export go_apache_request_cleanup
+func go_apache_request_cleanup(rh C.uintptr_t) {
+	if rh == 0 {
+		return
+	}
+
+	h := cgo.Handle(rh)
+	p := h.Value().(*runtime.Pinner)
+	p.Unpin()
+	h.Delete()
 }
 
 func addHeader(fc *FrankenPHPContext, cString *C.char, length C.int) {
 	parts := strings.SplitN(C.GoStringN(cString, length), ": ", 2)
 	if len(parts) != 2 {
-		fc.logger.Debug("invalid header", zap.String("header", parts[0]))
+		if c := fc.logger.Check(zapcore.DebugLevel, "invalid header"); c != nil {
+			c.Write(zap.String("header", parts[0]))
+		}
 
 		return
 	}
@@ -650,15 +716,10 @@ func go_sapi_flush(rh C.uintptr_t) bool {
 		return true
 	}
 
-	if r.ProtoMajor == 1 {
-		if _, err := r.Body.Read(nil); err != nil {
-			// Don't flush until the whole body has been read to prevent https://github.com/golang/go/issues/15527
-			return false
-		}
-	}
-
 	if err := http.NewResponseController(fc.responseWriter).Flush(); err != nil {
-		fc.logger.Error("the current responseWriter is not a flusher", zap.Error(err))
+		if c := fc.logger.Check(zapcore.ErrorLevel, "the current responseWriter is not a flusher"); c != nil {
+			c.Write(zap.Error(err))
+		}
 	}
 
 	return false
@@ -676,12 +737,6 @@ func go_read_post(rh C.uintptr_t, cBuf *C.char, countBytes C.size_t) (readBytes
 		readBytes += C.size_t(n)
 	}
 
-	if err != nil && err != io.EOF {
-		// invalid Read on closed Body may happen because of https://github.com/golang/go/issues/15527
-		fc, _ := FromContext(r.Context())
-		fc.logger.Error("error while reading the request body", zap.Error(err))
-	}
-
 	return
 }
 
@@ -698,7 +753,7 @@ func go_read_cookies(rh C.uintptr_t) *C.char {
 		cookieStrings[i] = cookie.String()
 	}
 
-	// freed in frankenphp_request_shutdown()
+	// freed in frankenphp_free_request_context()
 	return C.CString(strings.Join(cookieStrings, "; "))
 }
 
@@ -716,16 +771,24 @@ func go_log(message *C.char, level C.int) {
 
 	switch le {
 	case emerg, alert, crit, err:
-		l.Error(m, zap.Stringer("syslog_level", syslogLevel(level)))
+		if c := l.Check(zapcore.ErrorLevel, m); c != nil {
+			c.Write(zap.Stringer("syslog_level", syslogLevel(level)))
+		}
 
 	case warning:
-		l.Warn(m, zap.Stringer("syslog_level", syslogLevel(level)))
+		if c := l.Check(zapcore.WarnLevel, m); c != nil {
+			c.Write(zap.Stringer("syslog_level", syslogLevel(level)))
+		}
 
 	case debug:
-		l.Debug(m, zap.Stringer("syslog_level", syslogLevel(level)))
+		if c := l.Check(zapcore.DebugLevel, m); c != nil {
+			c.Write(zap.Stringer("syslog_level", syslogLevel(level)))
+		}
 
 	default:
-		l.Info(m, zap.Stringer("syslog_level", syslogLevel(level)))
+		if c := l.Check(zapcore.InfoLevel, m); c != nil {
+			c.Write(zap.Stringer("syslog_level", syslogLevel(level)))
+		}
 	}
 }
 

frankenphp.h

@@ -13,9 +13,15 @@
 
 typedef struct go_string {
   size_t len;
-  const char *data;
+  char *data;
 } go_string;
 
+typedef struct php_variable {
+  const char *var;
+  size_t data_len;
+  char *data;
+} php_variable;
+
 typedef struct frankenphp_version {
   unsigned char major_version;
   unsigned char minor_version;
@@ -44,9 +50,9 @@ int frankenphp_update_server_context(
     char *auth_user, char *auth_password, int proto_num);
 int frankenphp_request_startup();
 int frankenphp_execute_script(char *file_name);
-void frankenphp_register_bulk_variables(char *known_variables[27],
-                                        char **dynamic_variables, size_t size,
-                                        zval *track_vars_array);
+void frankenphp_register_bulk_variables(go_string known_variables[27],
+                                        php_variable *dynamic_variables,
+                                        size_t size, zval *track_vars_array);
 
 int frankenphp_execute_script_cli(char *script, int argc, char **argv);
 

frankenphp.stub.php

@@ -13,9 +13,22 @@ function frankenphp_finish_request(): bool {}
  */
 function fastcgi_finish_request(): bool {}
 
+function frankenphp_request_headers(): array {}
+
+/**
+ * @alias frankenphp_request_headers
+ */
 function apache_request_headers(): array {}
 
 /**
- * @alias apache_request_headers
+ * @alias frankenphp_request_headers
 */
 function getallheaders(): array {}
+
+function frankenphp_response_headers(): array|bool {}
+
+/**
+ * @alias frankenphp_response_headers
+ */
+function apache_response_headers(): array|bool {}
+

frankenphp_arginfo.h

@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: f925a1c280fb955eb32d0823cbd4f360b0cbabed */
+ * Stub hash: 05ebde17137c559e891362fba6524fad1e0a2dfe */
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_frankenphp_handle_request, 0, 1,
                                         _IS_BOOL, 0)
@@ -16,16 +16,25 @@ ZEND_END_ARG_INFO()
 
 #define arginfo_fastcgi_finish_request arginfo_frankenphp_finish_request
 
-ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_apache_request_headers, 0, 0,
-                                        IS_ARRAY, 0)
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_frankenphp_request_headers, 0,
+                                        0, IS_ARRAY, 0)
 ZEND_END_ARG_INFO()
 
-#define arginfo_getallheaders arginfo_apache_request_headers
+#define arginfo_apache_request_headers arginfo_frankenphp_request_headers
+
+#define arginfo_getallheaders arginfo_frankenphp_request_headers
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_frankenphp_response_headers, 0,
+                                        0, MAY_BE_ARRAY | MAY_BE_BOOL)
+ZEND_END_ARG_INFO()
+
+#define arginfo_apache_response_headers arginfo_frankenphp_response_headers
 
 ZEND_FUNCTION(frankenphp_handle_request);
 ZEND_FUNCTION(headers_send);
 ZEND_FUNCTION(frankenphp_finish_request);
-ZEND_FUNCTION(apache_request_headers);
+ZEND_FUNCTION(frankenphp_request_headers);
+ZEND_FUNCTION(frankenphp_response_headers);
 
 static const zend_function_entry ext_functions[] = {
     ZEND_FE(frankenphp_handle_request, arginfo_frankenphp_handle_request)
@@ -33,6 +42,16 @@ static const zend_function_entry ext_functions[] = {
             frankenphp_finish_request, arginfo_frankenphp_finish_request)
             ZEND_FALIAS(fastcgi_finish_request, frankenphp_finish_request,
                         arginfo_fastcgi_finish_request)
-                ZEND_FE(apache_request_headers, arginfo_apache_request_headers)
-                    ZEND_FALIAS(getallheaders, apache_request_headers,
-                                arginfo_getallheaders) ZEND_FE_END};
+                ZEND_FE(frankenphp_request_headers,
+                        arginfo_frankenphp_request_headers)
+                    ZEND_FALIAS(apache_request_headers,
+                                frankenphp_request_headers,
+                                arginfo_apache_request_headers)
+                        ZEND_FALIAS(getallheaders, frankenphp_request_headers,
+                                    arginfo_getallheaders)
+                            ZEND_FE(frankenphp_response_headers,
+                                    arginfo_frankenphp_response_headers)
+                                ZEND_FALIAS(apache_response_headers,
+                                            frankenphp_response_headers,
+                                            arginfo_apache_response_headers)
+                                    ZEND_FE_END};

frankenphp_test.go

@@ -1,10 +1,16 @@
+// In all tests, headers added to requests are copied on the heap using strings.Clone.
+// This was originally a workaround for https://github.com/golang/go/issues/65286#issuecomment-1920087884 (fixed in Go 1.22),
+// but this allows to catch panics occuring in real life but not when the string is in the internal binary memory.
+
 package frankenphp_test
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"io"
 	"log"
+	"mime/multipart"
 	"net/http"
 	"net/http/cookiejar"
 	"net/http/httptest"
@@ -22,6 +28,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
 	"go.uber.org/zap/zaptest"
 	"go.uber.org/zap/zaptest/observer"
 )
@@ -128,8 +135,8 @@ func TestServerVariable_worker(t *testing.T) {
 func testServerVariable(t *testing.T, opts *testOptions) {
 	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
 		req := httptest.NewRequest("POST", fmt.Sprintf("http://example.com/server-variable.php/baz/bat?foo=a&bar=b&i=%d#hash", i), strings.NewReader("foo"))
-		req.SetBasicAuth("kevin", "password")
-		req.Header.Add("Content-Type", "text/plain")
+		req.SetBasicAuth(strings.Clone("kevin"), strings.Clone("password"))
+		req.Header.Add(strings.Clone("Content-Type"), strings.Clone("text/plain"))
 		w := httptest.NewRecorder()
 		handler(w, req)
 
@@ -171,13 +178,14 @@ func TestPathInfo_worker(t *testing.T) {
 	testPathInfo(t, &testOptions{workerScript: "server-variable.php"})
 }
 func testPathInfo(t *testing.T, opts *testOptions) {
+	cwd, _ := os.Getwd()
+	testDataDir := cwd + strings.Clone("/testdata/")
+	path := strings.Clone("/server-variable.php/pathinfo")
+
 	runTest(t, func(_ func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
 		handler := func(w http.ResponseWriter, r *http.Request) {
-			cwd, _ := os.Getwd()
-			testDataDir := cwd + "/testdata/"
-
 			requestURI := r.URL.RequestURI()
-			r.URL.Path = "/server-variable.php/pathinfo"
+			r.URL.Path = path
 
 			rewriteRequest, err := frankenphp.NewRequestWithContext(r,
 				frankenphp.WithRequestDocumentRoot(testDataDir, false),
@@ -226,6 +234,33 @@ func testHeaders(t *testing.T, opts *testOptions) {
 	}, opts)
 }
 
+func TestResponseHeaders_module(t *testing.T) { testResponseHeaders(t, nil) }
+func TestResponseHeaders_worker(t *testing.T) {
+	testResponseHeaders(t, &testOptions{workerScript: "response-headers.php"})
+}
+func testResponseHeaders(t *testing.T, opts *testOptions) {
+	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
+		req := httptest.NewRequest("GET", fmt.Sprintf("http://example.com/response-headers.php?i=%d", i), nil)
+		w := httptest.NewRecorder()
+		handler(w, req)
+
+		resp := w.Result()
+		body, _ := io.ReadAll(resp.Body)
+
+		if i%3 != 0 {
+			assert.Equal(t, i+100, resp.StatusCode)
+		} else {
+			assert.Equal(t, 200, resp.StatusCode)
+		}
+
+		assert.Contains(t, string(body), "'X-Powered-By' => 'PH")
+		assert.Contains(t, string(body), "'Foo' => 'bar',")
+		assert.Contains(t, string(body), "'Foo2' => 'bar2',")
+		assert.Contains(t, string(body), fmt.Sprintf("'I' => '%d',", i))
+		assert.NotContains(t, string(body), "Invalid")
+	}, opts)
+}
+
 func TestInput_module(t *testing.T) { testInput(t, nil) }
 func TestInput_worker(t *testing.T) { testInput(t, &testOptions{workerScript: "input.php"}) }
 func testInput(t *testing.T, opts *testOptions) {
@@ -250,7 +285,7 @@ func testPostSuperGlobals(t *testing.T, opts *testOptions) {
 	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
 		formData := url.Values{"baz": {"bat"}, "i": {fmt.Sprintf("%d", i)}}
 		req := httptest.NewRequest("POST", fmt.Sprintf("http://example.com/super-globals.php?foo=bar&iG=%d", i), strings.NewReader(formData.Encode()))
-		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.Header.Set("Content-Type", strings.Clone("application/x-www-form-urlencoded"))
 		w := httptest.NewRecorder()
 		handler(w, req)
 
@@ -376,7 +411,7 @@ func TestLog_worker(t *testing.T) {
 	testLog(t, &testOptions{workerScript: "log.php"})
 }
 func testLog(t *testing.T, opts *testOptions) {
-	logger, logs := observer.New(zap.InfoLevel)
+	logger, logs := observer.New(zapcore.InfoLevel)
 	opts.logger = zap.New(logger)
 
 	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
@@ -396,7 +431,7 @@ func TestConnectionAbort_worker(t *testing.T) {
 func testConnectionAbort(t *testing.T, opts *testOptions) {
 	testFinish := func(finish string) {
 		t.Run(fmt.Sprintf("finish=%s", finish), func(t *testing.T) {
-			logger, logs := observer.New(zap.InfoLevel)
+			logger, logs := observer.New(zapcore.InfoLevel)
 			opts.logger = zap.New(logger)
 
 			runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
@@ -514,7 +549,7 @@ func testLargeRequest(t *testing.T, opts *testOptions) {
 		req := httptest.NewRequest(
 			"POST",
 			fmt.Sprintf("http://example.com/large-request.php?i=%d", i),
-			strings.NewReader(strings.Repeat("f", 1_048_576)),
+			strings.NewReader(strings.Repeat("f", 6_048_576)),
 		)
 		w := httptest.NewRecorder()
 		handler(w, req)
@@ -522,7 +557,7 @@ func testLargeRequest(t *testing.T, opts *testOptions) {
 		resp := w.Result()
 		body, _ := io.ReadAll(resp.Body)
 
-		assert.Contains(t, string(body), fmt.Sprintf("Request body size: 1048576 (%d)", i))
+		assert.Contains(t, string(body), fmt.Sprintf("Request body size: 6048576 (%d)", i))
 	}, opts)
 }
 
@@ -553,15 +588,15 @@ func testFiberNoCgo(t *testing.T, opts *testOptions) {
 	}, opts)
 }
 
-func TestApacheRequestHeaders_module(t *testing.T) { testApacheRequestHeaders(t, &testOptions{}) }
-func TestApacheRequestHeaders_worker(t *testing.T) {
-	testApacheRequestHeaders(t, &testOptions{workerScript: "apache-request-headers.php"})
+func TestRequestHeaders_module(t *testing.T) { testRequestHeaders(t, &testOptions{}) }
+func TestRequestHeaders_worker(t *testing.T) {
+	testRequestHeaders(t, &testOptions{workerScript: "request-headers.php"})
 }
-func testApacheRequestHeaders(t *testing.T, opts *testOptions) {
+func testRequestHeaders(t *testing.T, opts *testOptions) {
 	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
-		req := httptest.NewRequest("GET", fmt.Sprintf("http://example.com/apache-request-headers.php?i=%d", i), nil)
-		req.Header.Add("Content-Type", "text/plain")
-		req.Header.Add("Frankenphp-I", strconv.Itoa(i))
+		req := httptest.NewRequest("GET", fmt.Sprintf("http://example.com/request-headers.php?i=%d", i), nil)
+		req.Header.Add(strings.Clone("Content-Type"), strings.Clone("text/plain"))
+		req.Header.Add(strings.Clone("Frankenphp-I"), strings.Clone(strconv.Itoa(i)))
 
 		w := httptest.NewRecorder()
 		handler(w, req)
@@ -574,6 +609,33 @@ func testApacheRequestHeaders(t *testing.T, opts *testOptions) {
 	}, opts)
 }
 
+func TestFileUpload_module(t *testing.T) { testFileUpload(t, &testOptions{}) }
+func TestFileUpload_worker(t *testing.T) {
+	testFileUpload(t, &testOptions{workerScript: "file-upload.php"})
+}
+func testFileUpload(t *testing.T, opts *testOptions) {
+	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
+		requestBody := &bytes.Buffer{}
+		writer := multipart.NewWriter(requestBody)
+		part, _ := writer.CreateFormFile("file", "foo.txt")
+		_, err := part.Write([]byte("bar"))
+		require.NoError(t, err)
+
+		writer.Close()
+
+		req := httptest.NewRequest("POST", "http://example.com/file-upload.php", requestBody)
+		req.Header.Add("Content-Type", writer.FormDataContentType())
+
+		w := httptest.NewRecorder()
+		handler(w, req)
+
+		resp := w.Result()
+		body, _ := io.ReadAll(resp.Body)
+
+		assert.Contains(t, string(body), "Upload OK")
+	}, opts)
+}
+
 func TestExecuteScriptCLI(t *testing.T) {
 	if _, err := os.Stat("internal/testcli/testcli"); err != nil {
 		t.Skip("internal/testcli/testcli has not been compiled, run `cd internal/testcli/ && go build`")
@@ -644,6 +706,7 @@ func BenchmarkHelloWorld(b *testing.B) {
 	req := httptest.NewRequest("GET", "http://example.com/index.php", nil)
 	w := httptest.NewRecorder()
 
+	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		handler(w, req)
 	}
@@ -709,8 +772,79 @@ func BenchmarkEcho(b *testing.B) {
 	req := httptest.NewRequest("POST", "http://example.com/echo.php", r)
 	w := httptest.NewRecorder()
 
+	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		r.Reset(body)
 		handler(w, req)
 	}
 }
+
+func BenchmarkServerSuperGlobal(b *testing.B) {
+	if err := frankenphp.Init(frankenphp.WithLogger(zap.NewNop())); err != nil {
+		panic(err)
+	}
+	defer frankenphp.Shutdown()
+	cwd, _ := os.Getwd()
+	testDataDir := cwd + "/testdata/"
+
+	// Mimicks headers of a request sent by Firefox to GitHub
+	headers := http.Header{}
+	headers.Add(strings.Clone("Accept"), strings.Clone("text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"))
+	headers.Add(strings.Clone("Accept-Encoding"), strings.Clone("gzip, deflate, br"))
+	headers.Add(strings.Clone("Accept-Language"), strings.Clone("fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3"))
+	headers.Add(strings.Clone("Cache-Control"), strings.Clone("no-cache"))
+	headers.Add(strings.Clone("Connection"), strings.Clone("keep-alive"))
+	headers.Add(strings.Clone("Cookie"), strings.Clone("user_session=myrandomuuid; __Host-user_session_same_site=myotherrandomuuid; dotcom_user=dunglas; logged_in=yes; _foo=barbarbarbarbarbar; _device_id=anotherrandomuuid; color_mode=foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar; preferred_color_mode=light; tz=Europe%2FParis; has_recent_activity=1"))
+	headers.Add(strings.Clone("DNT"), strings.Clone("1"))
+	headers.Add(strings.Clone("Host"), strings.Clone("example.com"))
+	headers.Add(strings.Clone("Pragma"), strings.Clone("no-cache"))
+	headers.Add(strings.Clone("Sec-Fetch-Dest"), strings.Clone("document"))
+	headers.Add(strings.Clone("Sec-Fetch-Mode"), strings.Clone("navigate"))
+	headers.Add(strings.Clone("Sec-Fetch-Site"), strings.Clone("cross-site"))
+	headers.Add(strings.Clone("Sec-GPC"), strings.Clone("1"))
+	headers.Add(strings.Clone("Upgrade-Insecure-Requests"), strings.Clone("1"))
+	headers.Add(strings.Clone("User-Agent"), strings.Clone("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:122.0) Gecko/20100101 Firefox/122.0"))
+
+	// Env vars available in a typical Docker container
+	env := map[string]string{
+		"HOSTNAME":        "a88e81aa22e4",
+		"PHP_INI_DIR":     "/usr/local/etc/php",
+		"HOME":            "/root",
+		"GODEBUG":         "cgocheck=0",
+		"PHP_LDFLAGS":     "-Wl,-O1 -pie",
+		"PHP_CFLAGS":      "-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64",
+		"PHP_VERSION":     "8.3.2",
+		"GPG_KEYS":        "1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA",
+		"PHP_CPPFLAGS":    "-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64",
+		"PHP_ASC_URL":     "https://www.php.net/distributions/php-8.3.2.tar.xz.asc",
+		"PHP_URL":         "https://www.php.net/distributions/php-8.3.2.tar.xz",
+		"PATH":            "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+		"XDG_CONFIG_HOME": "/config",
+		"XDG_DATA_HOME":   "/data",
+		"PHPIZE_DEPS":     "autoconf dpkg-dev file g++ gcc libc-dev make pkg-config re2c",
+		"PWD":             "/app",
+		"PHP_SHA256":      "4ffa3e44afc9c590e28dc0d2d31fc61f0139f8b335f11880a121b9f9b9f0634e",
+	}
+
+	preparedEnv := frankenphp.PrepareEnv(env)
+
+	handler := func(w http.ResponseWriter, r *http.Request) {
+		req, err := frankenphp.NewRequestWithContext(r, frankenphp.WithRequestDocumentRoot(testDataDir, false), frankenphp.WithRequestPreparedEnv(preparedEnv))
+		if err != nil {
+			panic(err)
+		}
+
+		r.Header = headers
+		if err := frankenphp.ServeHTTP(w, req); err != nil {
+			panic(err)
+		}
+	}
+
+	req := httptest.NewRequest("GET", "http://example.com/server-variable.php", nil)
+	w := httptest.NewRecorder()
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		handler(w, req)
+	}
+}

go.mod

@@ -2,20 +2,26 @@ module github.com/dunglas/frankenphp
 
 go 1.21
 
+toolchain go1.22.0
+
 retract v1.0.0-rc.1 // Human error
 
 require (
-	github.com/stretchr/testify v1.8.4
-	go.uber.org/zap v1.26.0
-	golang.org/x/net v0.19.0
+	github.com/maypok86/otter v1.2.2
+	github.com/stretchr/testify v1.9.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/net v0.27.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/kr/pretty v0.2.1 // indirect
+	github.com/dolthub/maphash v0.1.0 // indirect
+	github.com/gammazero/deque v0.2.1 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,27 +1,39 @@
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
+github.com/dolthub/maphash v0.1.0 h1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L/QxPDyQ=
+github.com/dolthub/maphash v0.1.0/go.mod h1:gkg4Ch4CdCDu5h6PMriVLawB7koZ+5ijb9puGMV50a4=
+github.com/gammazero/deque v0.2.1 h1:qSdsbG6pgp6nL7A0+K/B7s12mcCY/5l5SIUpMOl+dC0=
+github.com/gammazero/deque v0.2.1/go.mod h1:LFroj8x4cMYCukHJDbxFCkT+r9AndaJnFMuZDV34tuU=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/maypok86/otter v1.2.2 h1:jJi0y8ruR/ZcKmJ4FbQj3QQTqKwV+LNrSOo2S1zbF5M=
+github.com/maypok86/otter v1.2.2/go.mod h1:mKLfoI7v1HOmQMwFgX4QkRk23mX6ge3RDvjdHOWG4R4=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
-go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys=
+golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

options.go

@@ -19,7 +19,7 @@ type opt struct {
 type workerOpt struct {
 	fileName string
 	num      int
-	env      map[string]string
+	env      PreparedEnv
 }
 
 // WithNumThreads configures the number of PHP threads to start.
@@ -34,7 +34,7 @@ func WithNumThreads(numThreads int) Option {
 // WithWorkers configures the PHP workers to start.
 func WithWorkers(fileName string, num int, env map[string]string) Option {
 	return func(o *opt) error {
-		o.workers = append(o.workers, workerOpt{fileName, num, env})
+		o.workers = append(o.workers, workerOpt{fileName, num, PrepareEnv(env)})
 
 		return nil
 	}

release.sh

@@ -9,25 +9,25 @@ set -o errtrace
 set -o pipefail
 set -o xtrace
 
-if ! type "git" > /dev/null; then
-    echo "The \"git\" command must be installed."
-    exit 1
+if ! type "git" >/dev/null; then
+	echo "The \"git\" command must be installed."
+	exit 1
 fi
 
-if ! type "gh" > /dev/null; then
-    echo "The \"gh\" command must be installed."
-    exit 1
+if ! type "gh" >/dev/null; then
+	echo "The \"gh\" command must be installed."
+	exit 1
 fi
 
 if [[ $# -ne 1 ]]; then
-    echo "Usage: ./release.sh version" >&2
-    exit 1
+	echo "Usage: ./release.sh version" >&2
+	exit 1
 fi
 
 # Adapted from https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
 if [[ ! $1 =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)(\.(0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*))?(\+([0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*))?$ ]]; then
-    echo "Invalid version number: $1" >&2
-    exit 1
+	echo "Invalid version number: $1" >&2
+	exit 1
 fi
 
 git checkout main
@@ -44,11 +44,6 @@ git tag -s -m "Version $1" "caddy/v$1"
 git push --follow-tags
 
 tags=$(git tag --list --sort=-version:refname 'v*')
-previous_tag=$(awk 'NR==2 {print;exit}' <<< "${tags}")
+previous_tag=$(awk 'NR==2 {print;exit}' <<<"${tags}")
 
 gh release create --draft --generate-notes --latest --notes-start-tag "${previous_tag}" --verify-tag "v$1"
-
-if [[ "$(uname -s)" = "Darwin" ]]; then
-    rm -Rf dist/*
-    FRANKENPHP_VERSION=$1 RELEASE=1 ./build-static.sh
-fi

reload_test.sh

@@ -1,4 +1,4 @@
 #!/bin/bash
-for ((i = 0 ; i < 100 ; i++)); do
-    curl --no-progress-meter -o /dev/null http://localhost:2019/config/apps/frankenphp -: --no-progress-meter -o /dev/null -H 'Cache-Control: must-revalidate' -H 'Content-Type: application/json' --data-binary '{"workers":[{"file_name":"./index.php"}]}' -X PATCH http://localhost:2019/config/apps/frankenphp
+for ((i = 0; i < 100; i++)); do
+	curl --no-progress-meter -o /dev/null http://localhost:2019/config/apps/frankenphp -: --no-progress-meter -o /dev/null -H 'Cache-Control: must-revalidate' -H 'Content-Type: application/json' --data-binary '{"workers":[{"file_name":"./index.php"}]}' -X PATCH http://localhost:2019/config/apps/frankenphp
 done

request_options.go

@@ -36,6 +36,16 @@ func WithRequestDocumentRoot(documentRoot string, resolveSymlink bool) RequestOp
 	}
 }
 
+// WithRequestResolvedDocumentRoot is similar to WithRequestDocumentRoot
+// but doesn't does any checks or resolving on the path to improve performance.
+func WithRequestResolvedDocumentRoot(documentRoot string) RequestOption {
+	return func(o *FrankenPHPContext) error {
+		o.documentRoot = documentRoot
+
+		return nil
+	}
+}
+
 // The path in the URL will be split into two, with the first piece ending
 // with the value of SplitPath. The first piece will be assumed as the
 // actual resource (CGI script) name, and the second piece will be set to
@@ -52,9 +62,24 @@ func WithRequestSplitPath(splitPath []string) RequestOption {
 	}
 }
 
-// WithEnv set CGI-like environment variables that will be available in $_SERVER.
+type PreparedEnv = map[string]string
+
+func PrepareEnv(env map[string]string) PreparedEnv {
+	preparedEnv := make(PreparedEnv, len(env))
+	for k, v := range env {
+		preparedEnv[k+"\x00"] = v
+	}
+
+	return preparedEnv
+}
+
+// WithRequestEnv set CGI-like environment variables that will be available in $_SERVER.
 // Values set with WithEnv always have priority over automatically populated values.
 func WithRequestEnv(env map[string]string) RequestOption {
+	return WithRequestPreparedEnv(PrepareEnv(env))
+}
+
+func WithRequestPreparedEnv(env PreparedEnv) RequestOption {
 	return func(o *FrankenPHPContext) error {
 		o.env = env
 
@@ -62,7 +87,7 @@ func WithRequestEnv(env map[string]string) RequestOption {
 	}
 }
 
-// WithLogger sets the logger associated with the current request
+// WithRequestLogger sets the logger associated with the current request
 func WithRequestLogger(logger *zap.Logger) RequestOption {
 	return func(o *FrankenPHPContext) error {
 		o.logger = logger

static-builder.Dockerfile

@@ -1,6 +1,11 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM golang-base
 
+ARG TARGETARCH
+
 ARG FRANKENPHP_VERSION=''
 ENV FRANKENPHP_VERSION=${FRANKENPHP_VERSION}
 
@@ -8,13 +13,13 @@ ARG PHP_VERSION=''
 ENV PHP_VERSION=${PHP_VERSION}
 
 ARG PHP_EXTENSIONS=''
-ENV PHP_EXTENSIONS=${PHP_EXTENSIONS}
-
 ARG PHP_EXTENSION_LIBS=''
-ENV PHP_EXTENSION_LIBS=${PHP_EXTENSION_LIBS}
-
 ARG CLEAN=''
 ARG EMBED=''
+ARG DEBUG_SYMBOLS=''
+ARG MIMALLOC=''
+ARG NO_COMPRESS=''
+
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 
 LABEL org.opencontainers.image.title=FrankenPHP
@@ -26,6 +31,7 @@ LABEL org.opencontainers.image.vendor="Kévin Dunglas"
 
 RUN apk update; \
 	apk add --no-cache \
+		alpine-sdk \
 		autoconf \
 		automake \
 		bash \
@@ -47,11 +53,6 @@ RUN apk update; \
 		m4 \
 		make \
 		pkgconfig \
-		wget \
-		xz ; \
-	apk add --no-cache \
-		--repository=https://dl-cdn.alpinelinux.org/alpine/edge/main \
-		--repository=https://dl-cdn.alpinelinux.org/alpine/edge/community \
 		php83 \
 		php83-common \
 		php83-ctype \
@@ -66,14 +67,30 @@ RUN apk update; \
 		php83-sodium \
 		php83-tokenizer \
 		php83-xml \
-		php83-xmlwriter; \
+		php83-xmlwriter \
+		upx \
+		wget \
+		xz ; \
 	ln -sf /usr/bin/php83 /usr/bin/php
 
+# FIXME: temporary workaround for https://github.com/golang/go/issues/68285
+WORKDIR /
+RUN git clone https://go.googlesource.com/go goroot
+WORKDIR /goroot
+# Revert https://github.com/golang/go/commit/3560cf0afb3c29300a6c88ccd98256949ca7a6f6 to prevent the crash with musl
+RUN git config --global user.email "build@example.com" && \
+	git config --global user.name "Build" && \
+	git checkout "$(go env GOVERSION)" && \
+	git revert 3560cf0afb3c29300a6c88ccd98256949ca7a6f6
+WORKDIR /goroot/src
+ENV GOHOSTARCH="$TARGETARCH"
+RUN ./make.bash
+ENV PATH="/goroot/bin:$PATH"
+RUN go version
+
 # https://getcomposer.org/doc/03-cli.md#composer-allow-superuser
 ENV COMPOSER_ALLOW_SUPERUSER=1
-ENV PATH="${PATH}:/root/.composer/vendor/bin"
-
-COPY --from=composer/composer:2-bin --link /composer /usr/bin/composer
+COPY --from=composer/composer:2-bin /composer /usr/bin/composer
 
 WORKDIR /go/src/app
 COPY go.mod go.sum ./
@@ -86,6 +103,6 @@ RUN go mod graph | awk '{if ($1 !~ "@") print $2}' | xargs go get
 WORKDIR /go/src/app
 COPY *.* ./
 COPY caddy caddy
-COPY C-Thread-Pool C-Thread-Pool
 
-RUN --mount=type=secret,id=github-token GITHUB_TOKEN=$(cat /run/secrets/github-token) ./build-static.sh
+RUN --mount=type=secret,id=github-token GITHUB_TOKEN=$(cat /run/secrets/github-token) ./build-static.sh && \
+	rm -Rf dist/static-php-cli/source/*

testdata/_executor.php

@@ -1,7 +1,7 @@
 <?php
 
 $fn = require $_SERVER['SCRIPT_FILENAME'];
-if (!isset($_SERVER['FRANKENPHP_WORKER'])) {
+if ('1' !== ($_SERVER['FRANKENPHP_WORKER'] ?? null)) {
     $fn();
     exit(0);
 }

testdata/benchmark.Caddyfile

@@ -7,6 +7,9 @@ http:// {
 		root * .
 
 		encode zstd br gzip
-		php_server
+		php_server {
+			file_server off
+			resolve_root_symlink false
+		}
 	}
 }

testdata/file-upload.php

@@ -0,0 +1,18 @@
+<?php
+require_once __DIR__.'/_executor.php';
+
+return function()
+{
+    $uploaded = ($_FILES['file']['tmp_name'] ?? null) ? file_get_contents($_FILES['file']['tmp_name']) : null;
+    if ($uploaded) {
+        echo 'Upload OK'; 
+        return;
+    }
+
+    echo <<<'HTML'
+    <form method="POST" enctype="multipart/form-data">
+        <input type="file" name="file">
+        <input type="submit">
+    </form>
+    HTML;
+};