simplerisk · WolfangAukang · May 20, 2026 · May 19, 2026 · May 19, 2026 · May 19, 2026
diff --git a/.github/workflows/container-validation.yml b/.github/workflows/container-validation.yml
@@ -24,20 +24,20 @@ jobs:
       image_tag: "simplerisk/simplerisk:testing"
       build_args: "ubuntu_version_code=noble"
 
-  simplerisk-minimal-php81:
-    name: 'Verify simplerisk/simplerisk-minimal image based on PHP 8.1 with Apache'
+  simplerisk-minimal-php84:
+    name: 'Verify simplerisk/simplerisk-minimal image based on PHP 8.4 with Apache'
     uses: ./.github/workflows/verify-image_rw.yml
     with:
       context_path: "simplerisk-minimal/"
       dockerfile_path: "simplerisk-minimal/Dockerfile"
       image_tag: "simplerisk/simplerisk-minimal:testing"
-      build_args: "php_version=8.1"
+      build_args: "php_version=8.4"
 
-  simplerisk-minimal-php83:
-    name: 'Verify simplerisk/simplerisk-minimal image based on PHP 8.3 with Apache'
+  simplerisk-minimal-php85:
+    name: 'Verify simplerisk/simplerisk-minimal image based on PHP 8.5 with Apache'
     uses: ./.github/workflows/verify-image_rw.yml
     with:
       context_path: "simplerisk-minimal/"
       dockerfile_path: "simplerisk-minimal/Dockerfile"
       image_tag: "simplerisk/simplerisk-minimal:testing"
-      build_args: "php_version=8.3"
+      build_args: "php_version=8.5"
diff --git a/.github/workflows/push-to-dockerhub.yml b/.github/workflows/push-to-dockerhub.yml
@@ -36,28 +36,28 @@ jobs:
       main_image: true
       build_args: "ubuntu_version_code=noble"
     secrets: inherit
-  simplerisk-minimal-php81:
-    name: 'Push simplerisk/simplerisk-minimal image based on PHP 8.1 with Apache'
+  simplerisk-minimal-php84:
+    name: 'Push simplerisk/simplerisk-minimal image based on PHP 8.4 with Apache'
     uses: ./.github/workflows/push-to-dockerhub_rw.yml
     with:
       context_path: "simplerisk-minimal"
       dockerfile_path: "simplerisk-minimal/Dockerfile"
       image_name: "simplerisk/simplerisk-minimal"
       version: "20260422-001"
-      os_version: "php81"
-      build_args: "php_version=8.1"
+      os_version: "php84"
+      build_args: "php_version=8.4"
       platforms: linux/amd64,linux/arm64
     secrets: inherit
-  simplerisk-minimal-php83:
-    name: 'Push simplerisk/simplerisk-minimal image based on PHP 8.3 with Apache'
+  simplerisk-minimal-php85:
+    name: 'Push simplerisk/simplerisk-minimal image based on PHP 8.5 with Apache'
     uses: ./.github/workflows/push-to-dockerhub_rw.yml
     with:
       context_path: "simplerisk-minimal"
       dockerfile_path: "simplerisk-minimal/Dockerfile"
       image_name: "simplerisk/simplerisk-minimal"
       version: "20260422-001"
-      os_version: "php83"
+      os_version: "php85"
       main_image: true
-      build_args: "php_version=8.3"
+      build_args: "php_version=8.5"
       platforms: linux/amd64,linux/arm64
     secrets: inherit
diff --git a/.github/workflows/push-to-gh-pkgs.yml b/.github/workflows/push-to-gh-pkgs.yml
@@ -36,26 +36,26 @@ jobs:
       main_image: true
       build_args: "ubuntu_version_code=noble"
     secrets: inherit
-  simplerisk-minimal-php81:
-    name: 'Push simplerisk/simplerisk-minimal image based on PHP 8.1 with Apache'
+  simplerisk-minimal-php84:
+    name: 'Push simplerisk/simplerisk-minimal image based on PHP 8.4 with Apache'
     uses: ./.github/workflows/push-to-gh-pkgs_rw.yml
     with:
       context_path: "simplerisk-minimal"
       dockerfile_path: "simplerisk-minimal/Dockerfile"
       image_name: "simplerisk-minimal"
       version: "20260422-001"
-      os_version: "php81"
-      build_args: "php_version=8.1"
+      os_version: "php84"
+      build_args: "php_version=8.4"
     secrets: inherit
-  simplerisk-minimal-php83:
-    name: 'Push simplerisk/simplerisk-minimal image based on PHP 8.3 with Apache'
+  simplerisk-minimal-php85:
+    name: 'Push simplerisk/simplerisk-minimal image based on PHP 8.5 with Apache'
     uses: ./.github/workflows/push-to-gh-pkgs_rw.yml
     with:
       context_path: "simplerisk-minimal"
       dockerfile_path: "simplerisk-minimal/Dockerfile"
       image_name: "simplerisk-minimal"
       version: "20260422-001"
-      os_version: "php83"
+      os_version: "php85"
       main_image: true
-      build_args: "php_version=8.3"
+      build_args: "php_version=8.5"
     secrets: inherit
diff --git a/simplerisk-minimal/Dockerfile b/simplerisk-minimal/Dockerfile
@@ -1,5 +1,5 @@
 # Dockerfile generated by script
-ARG php_version=8.4
+ARG php_version=8.5
 
 FROM alpine/curl:8.12.1 AS downloader
 

diff --git a/simplerisk-minimal/README.md b/simplerisk-minimal/README.md
diff --git a/simplerisk-minimal/common/entrypoint.sh b/simplerisk-minimal/common/entrypoint.sh
@@ -40,19 +40,32 @@ validate_db_setup(){
 			print_log "initial_info:setup" "Setting database through the automatic process";;
 		automatic-only)
 			print_log "initial_info:setup" "Setting database through the automatic process and removing container";;
-		manual)
-			print_log "initial_info:setup" "Database will be set manually";;
 		delete)
 			print_log "initial_info:setup" "Perform deletion of database";;
 		"")
 			print_log "initial_info:setup" "Database is already set";;
 		*)
-			fatal_error "The provided option for DB_SETUP is invalid. It must be automatic, automatic-only or manual.";;
+			fatal_error "The provided option for DB_SETUP is invalid. It must be automatic, automatic-only or delete.";;
 	esac
 }
 
 set_config(){
-	CONFIG_PATH='/var/www/simplerisk/includes/config.php'
+	local CONFIG_PATH='/var/www/simplerisk/includes/config.php'
+	local CONFIG_SAMPLE_PATH='/var/www/simplerisk/includes/config.sample.php'
+
+	# Copy the sample config into place. The new SimpleRisk release ships
+	# config.sample.php; the entrypoint creates config.php from it before
+	# substituting env-var-driven values. For users upgrading from an older
+	# image on a persisted /var/www/simplerisk volume, config.sample.php
+	# won't be present — fall back to reusing the existing config.php, which
+	# the subsequent sed substitutions will rewrite in place.
+	if [ -f "$CONFIG_SAMPLE_PATH" ]; then
+		cp "$CONFIG_SAMPLE_PATH" "$CONFIG_PATH"
+	elif [ ! -f "$CONFIG_PATH" ]; then
+		fatal_error "Neither $CONFIG_SAMPLE_PATH nor $CONFIG_PATH is present. The /var/www/simplerisk volume appears to be in an inconsistent state."
+	else
+		print_log "initial_setup:info" "$CONFIG_SAMPLE_PATH not found; reusing existing $CONFIG_PATH (likely upgrading from an older image on a persisted volume)."
+	fi
 
 	# Replacing config variables if they exist
 	SIMPLERISK_DB_HOSTNAME=${SIMPLERISK_DB_HOSTNAME:-localhost} && exec_cmd "sed -i \"s/\('DB_HOSTNAME', '\).*\(');\)/\1$SIMPLERISK_DB_HOSTNAME\2/g\" $CONFIG_PATH"
@@ -70,15 +83,6 @@ set_config(){
 
 	# shellcheck disable=SC2015
 	[ -n "${SIMPLERISK_DB_SSL_CERT_PATH:-}" ] && sed -i "s/\('DB_SSL_CERTIFICATE_PATH', '\).*\(');\)/\1$SIMPLERISK_DB_SSL_CERT_PATH\2/g" $CONFIG_PATH || true
-
-	# If DB_SETUP is not set, update the SIMPLERISK_INSTALLED value to true
-	# shellcheck disable=SC2015
-	[ -z "${DB_SETUP:-}" ] && exec_cmd "sed -i \"s/\('SIMPLERISK_INSTALLED', \)'false'/\1'true'/g\" $CONFIG_PATH" || true
-
-	# Testing related operations
-	if [ "$version" = "testing" ]; then
-		exec_cmd "sed -i \"s|//\(define('.*_URL\)|\1|g\" $CONFIG_PATH"
-	fi
 }
 
 set_csrf_secret(){
@@ -253,9 +257,6 @@ EOSQL" "Was not able to apply settings on database. Check error above. Exiting."
 	print_log "initial_setup:info" "Removing schema file..."
 	exec_cmd "rm ${SCHEMA_FILE}"
 
-	# Update the SIMPLERISK_INSTALLED value
-	exec_cmd "sed -i \"s/\('SIMPLERISK_INSTALLED', \)'false'/\1'true'/g\" $CONFIG_PATH"
-
 	# Create admin user if ADMIN_USERNAME is provided (optional, non-fatal)
 	if [ -n "${ADMIN_USERNAME:-}" ]; then
 		exec_cmd_nobail "php /docker/configure-admin.php" || print_log "initial_setup:warn" "Admin user creation failed; check output above"
@@ -299,21 +300,47 @@ unset_variables() {
 }
 
 _main() {
-	validate_db_setup
-	set_config
+	# Detect whether the operator has opted into Docker-managed config
+	# provisioning. If no DB env vars are set, leave config.php absent so
+	# SimpleRisk's web installer runs on first request.
+	local docker_managed_config=false
+	if [ -n "${DB_SETUP:-}" ] \
+	    || [ -n "${SIMPLERISK_DB_HOSTNAME:-}" ] \
+	    || [ -n "${SIMPLERISK_DB_PORT:-}" ] \
+	    || [ -n "${SIMPLERISK_DB_USERNAME:-}" ] \
+	    || [ -n "${SIMPLERISK_DB_PASSWORD:-}" ] \
+	    || [ -n "${SIMPLERISK_DB_DATABASE:-}" ] \
+	    || [ -n "${SIMPLERISK_DB_FOR_SESSIONS:-}" ] \
+	    || [ -n "${SIMPLERISK_DB_SSL_CERT_PATH:-}" ]; then
+		docker_managed_config=true
+	fi
+
+	if [ "$docker_managed_config" = true ]; then
+		validate_db_setup
+		set_config
+	else
+		print_log "initial_setup:info" "No DB env vars provided; config.php will not be written. The SimpleRisk web installer will run at first request."
+	fi
+
 	set_cron
+
 	if [[ -n ${DB_SETUP:-} ]]; then
 	  DB_SETUP_USER="${DB_SETUP_USER:-root}"
 	  DB_SETUP_PASS="${DB_SETUP_PASS:-root}"
 	fi
+
 	if [[ -n ${SIMPLERISK_CSRF_SECRET:-} ]]; then
 	  set_csrf_secret
 	fi
-	# shellcheck disable=SC2015
-	[[ "${DB_SETUP:-}" == "delete" ]] && delete_db || true
-	# shellcheck disable=SC2015
-	[[ "${DB_SETUP:-}" = automatic* ]] && db_setup || true
-	set_mail_settings
+
+	if [ "$docker_managed_config" = true ]; then
+		# shellcheck disable=SC2015
+		[[ "${DB_SETUP:-}" == "delete" ]] && delete_db || true
+		# shellcheck disable=SC2015
+		[[ "${DB_SETUP:-}" = automatic* ]] && db_setup || true
+		set_mail_settings
+	fi
+
 	unset_variables
 	exec "$@"
 }

diff --git a/simplerisk-minimal/generate_dockerfile.sh b/simplerisk-minimal/generate_dockerfile.sh
@@ -15,7 +15,7 @@ fi
 
 cat << EOF > "${SCRIPT_LOCATION}/Dockerfile"
 # Dockerfile generated by script
-ARG php_version=8.4
+ARG php_version=8.5
 
 EOF
 

diff --git a/simplerisk/common/entrypoint.sh b/simplerisk/common/entrypoint.sh
@@ -27,7 +27,24 @@ set_config(){
 	if [ ! -f /configurations/simplerisk-config-configured ]; then
 		print_log "initial_setup:config" "Setting up SimpleRisk's configuration"
 
-		CONFIG_PATH='/var/www/simplerisk/includes/config.php'
+		local CONFIG_PATH='/var/www/simplerisk/includes/config.php'
+		local CONFIG_SAMPLE_PATH='/var/www/simplerisk/includes/config.sample.php'
+
+		# Copy the sample config into place. The SimpleRisk release ships
+		# config.sample.php; the entrypoint creates config.php from it
+		# before substituting the values generated below. For users
+		# upgrading from an older image on a persisted /var/www/simplerisk
+		# volume, config.sample.php won't be present — fall back to
+		# reusing the existing config.php, which the subsequent sed
+		# substitutions will rewrite in place.
+		if [ -f "$CONFIG_SAMPLE_PATH" ]; then
+			cp "$CONFIG_SAMPLE_PATH" "$CONFIG_PATH"
+		elif [ ! -f "$CONFIG_PATH" ]; then
+			print_log "initial_setup:error" "Neither $CONFIG_SAMPLE_PATH nor $CONFIG_PATH is present. The /var/www/simplerisk volume appears to be in an inconsistent state."
+			exit 1
+		else
+			print_log "initial_setup:info" "$CONFIG_SAMPLE_PATH not found; reusing existing $CONFIG_PATH (likely upgrading from an older image on a persisted volume)."
+		fi
 
 		SIMPLERISK_DB_HOSTNAME='127.0.0.1'
 
@@ -37,9 +54,6 @@ set_config(){
 		set_db_password
 		SIMPLERISK_DB_DATABASE=simplerisk && sed -i "s/\('DB_DATABASE', '\).*\(');\)/\1$SIMPLERISK_DB_DATABASE\2/g" $CONFIG_PATH
 
-		# shellcheck disable=SC2015
-		[ "${version:-}" == "testing" ] && sed -i "s|//\(define('.*_URL\)|\1|g" $CONFIG_PATH || true
-
 		# Create a file so this doesn't run again
 		touch /configurations/simplerisk-config-configured
 
@@ -70,9 +84,6 @@ configure_db() {
 		run_sql_command "${password}" "GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER ON simplerisk.* TO 'simplerisk'@'${SIMPLERISK_DB_HOSTNAME}'"
 		run_sql_command "${password}" "UPDATE mysql.db SET References_priv='Y',Index_priv='Y' WHERE db='simplerisk';"
 
-		# Update the SIMPLERISK_INSTALLED value because of the DB installation
-		sed -i "s/\('SIMPLERISK_INSTALLED', 'false'\)/'SIMPLERISK_INSTALLED', 'true'/g" $CONFIG_PATH
-
 		# Create a file so this doesn't run again
 		touch /configurations/mysql-configured