Fix: Drupal installation now completes successfully (permissions, PDO, and correct paths)

- Added database readiness wait and proper Drush installation command
- Ensured /sites/default/files is writable before installation
- Switched to /opt/drupal/web as canonical Drupal root
- Added missing PHP extension pdo_mysql
- Adjusted Dockerfile and Compose volume paths
- Drupal installation now runs successfully end-to-end

Details: https://chatgpt.com/share/6905bb12-6de8-800f-be8c-b565d5ec6cdb

roles/web-app-drupal/tasks/00_permissions.yml

@@ -0,0 +1,11 @@
+- name: "Ensure sites/default/files exists and is writable"
+  command: >
+    docker exec -u root {{ DRUPAL_CONTAINER }} bash -lc
+    "set -e;
+     d='{{ DRUPAL_DOCKER_HTML_PATH }}/sites/default';
+     f=\"$d/files\";
+     mkdir -p \"$f\";
+     chown -R {{ DRUPAL_USER }}:{{ DRUPAL_USER }} \"$d\";
+     find \"$d\" -type d -exec chmod 775 {} +;
+     find \"$d\" -type f -exec chmod 664 {} +;"
+  changed_when: true

roles/web-app-drupal/tasks/02_install.yml

@@ -1,8 +1,25 @@
+- name: "Wait for database readiness"
+  command: >
+    docker exec {{ DRUPAL_CONTAINER }} bash -lc
+    "php -r '
+      $h=\"{{ database_host }}\"; $p={{ database_port }};
+      $d=\"{{ database_name }}\"; $u=\"{{ database_username }}\"; $pw=\"{{ database_password }}\";
+      $t=microtime(true)+60; $ok=false;
+      while (microtime(true)<$t) {
+        try { new PDO(\"mysql:host=$h;port=$p;dbname=$d;charset=utf8mb4\", $u, $pw,[PDO::ATTR_TIMEOUT=>2]); $ok=true; break; }
+        catch (Exception $e) { usleep(300000); }
+      }
+      if (!$ok) { fwrite(STDERR, \"DB not ready\\n\"); exit(1); }'"
+  register: db_wait
+  retries: 1
+  failed_when: db_wait.rc != 0
+
 - name: "Run Drupal site:install via Drush"
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
   command: >
     docker exec {{ DRUPAL_CONTAINER }} bash -lc
-    "/var/www/html/vendor/bin/drush -r {{ DRUPAL_DOCKER_HTML_PATH }} si standard -y
+    "/opt/drupal/vendor/bin/drush -r {{ DRUPAL_DOCKER_HTML_PATH }} site:install standard -y
+    --db-url='mysql://{{ database_username }}:{{ database_password }}@{{ database_host }}:{{ database_port }}/{{ database_name }}'
     --site-name='{{ applications | get_app_conf(application_id, 'title', True) }}'
     --account-name='{{ applications | get_app_conf(application_id, 'users.administrator.username') }}'
     --account-mail='{{ applications | get_app_conf(application_id, 'users.administrator.email', True) }}'

roles/web-app-drupal/tasks/03_enable_modules.yml

@@ -1,12 +1,12 @@
 - name: "Enable OpenID Connect core module"
   command: >
     docker exec {{ DRUPAL_CONTAINER }} bash -lc
-    "/var/www/html/vendor/bin/drush -r {{ DRUPAL_DOCKER_HTML_PATH }} en openid_connect -y"
+    "drush -r {{ DRUPAL_DOCKER_HTML_PATH }} en openid_connect -y"
   changed_when: true
 
 - name: "Enable OpenID Connect Keycloak preset (submodule of openid_connect)"
   command: >
     docker exec {{ DRUPAL_CONTAINER }} bash -lc
-    "/var/www/html/vendor/bin/drush -r {{ DRUPAL_DOCKER_HTML_PATH }} en openid_connect_client_keycloak -y"
+    "drush -r {{ DRUPAL_DOCKER_HTML_PATH }} en openid_connect_client_keycloak -y"
   changed_when: true
   failed_when: false

roles/web-app-drupal/tasks/04_configure_oidc.yml

@@ -9,7 +9,7 @@
     label: "{{ item.key }}"
   command: >
     docker exec {{ DRUPAL_CONTAINER }} bash -lc
-    "/var/www/html/vendor/bin/drush -r {{ DRUPAL_DOCKER_HTML_PATH }} cset -y
+    "drush -r {{ DRUPAL_DOCKER_HTML_PATH }} cset -y
     openid_connect.settings {{ item.key }}
     {{ (item.value | to_json) if item.value is mapping or item.value is sequence else item.value }}"
 
@@ -19,7 +19,7 @@
     client_label: "{{ oidc_vars.oidc_client.label }}"
   command: >
     docker exec {{ DRUPAL_CONTAINER }} bash -lc
-    "/var/www/html/vendor/bin/drush -r {{ DRUPAL_DOCKER_HTML_PATH }} eval '
+    "drush -r {{ DRUPAL_DOCKER_HTML_PATH }} eval '
     $id=\"{{ client_id }}\"; $label=\"{{ client_label }}\";
     $storage=\Drupal::entityTypeManager()->getStorage(\"openid_connect_client\");
     if (!$storage->load($id)) {
@@ -40,7 +40,7 @@
     label: "{{ item.key }}"
   command: >
     docker exec {{ DRUPAL_CONTAINER }} bash -lc
-    "/var/www/html/vendor/bin/drush -r {{ DRUPAL_DOCKER_HTML_PATH }} eval '
+    "drush -r {{ DRUPAL_DOCKER_HTML_PATH }} eval '
     $id=\"{{ client_id }}\";
     $key=\"{{ item.key }}\";
     $val=json_decode(base64_decode(\"{{ (item.value | to_json | b64encode) }}\"), true);
@@ -55,5 +55,5 @@
 - name: "Clear caches after OIDC config"
   command: >
     docker exec {{ DRUPAL_CONTAINER }} bash -lc
-    "/var/www/html/vendor/bin/drush -r {{ DRUPAL_DOCKER_HTML_PATH }} cr"
+    "drush -r {{ DRUPAL_DOCKER_HTML_PATH }} cr"
   changed_when: false

roles/web-app-drupal/tasks/main.yml

@@ -37,6 +37,9 @@
 - name: Flush handlers to make container ready
   meta: flush_handlers
 
+- name: "Fix permissions for sites/default/files"
+  include_tasks: 00_permissions.yml
+
 - name: "Ensure settings.php includes settings.local.php"
   include_tasks: 01_settings_local_include.yml
 

roles/web-app-drupal/templates/Dockerfile.j2

@@ -7,6 +7,11 @@ RUN apt-get update && \
     apt-get install -y msmtp msmtp-mta git unzip zip less nano curl vim && \
     rm -rf /var/lib/apt/lists/*
 
+# -------------------------------------------------------------------
+# PHP extensions required by Drupal/Drush bootstrap
+# -------------------------------------------------------------------
+RUN docker-php-ext-install -j"$(nproc)" pdo_mysql
+
 # -------------------------------------------------------------------
 # Install Composer
 # -------------------------------------------------------------------
@@ -19,7 +24,7 @@ ENV COMPOSER_ALLOW_SUPERUSER=1
 # -------------------------------------------------------------------
 # Build Drupal project with Drush + OpenID Connect
 # IMPORTANT:
-# - The Drupal base image uses /var/www/html as a symlink to /opt/drupal/web
+# - The Drupal base image uses /var/www/html as a symlink to {{ DRUPAL_DOCKER_HTML_PATH }}
 # - Therefore, the actual project root must be placed in /opt/drupal
 # -------------------------------------------------------------------
 RUN set -eux; \
@@ -34,7 +39,8 @@ RUN set -eux; \
 # -------------------------------------------------------------------
 # Make vendor binaries available in PATH
 # -------------------------------------------------------------------
-ENV PATH="/opt/drupal/vendor/bin:${PATH}"
+# Make drush unconditionally available on PATH (also if PATH is overridden)
+RUN ln -sf /opt/drupal/vendor/bin/drush /usr/local/bin/drush
 
 # -------------------------------------------------------------------
 # PHP upload configuration
@@ -55,19 +61,19 @@ RUN set -eux; \
   # Ensure vendor binaries are executable
   if [ -d /opt/drupal/vendor/bin ]; then chmod a+rx /opt/drupal/vendor/bin/*; fi; \
   if [ -f /opt/drupal/vendor/drush/drush/drush ]; then chmod a+rx /opt/drupal/vendor/drush/drush/drush; fi; \
-  # Ensure the docroot (/opt/drupal/web) is accessible
-  if [ -d /opt/drupal/web ]; then \
-    chmod 755 /opt/drupal/web; \
-    find /opt/drupal/web -type d -exec chmod 755 {} +; \
+  # Ensure the docroot ({{ DRUPAL_DOCKER_HTML_PATH }}) is accessible
+  if [ -d {{ DRUPAL_DOCKER_HTML_PATH }} ]; then \
+    chmod 755 {{ DRUPAL_DOCKER_HTML_PATH }}; \
+    find {{ DRUPAL_DOCKER_HTML_PATH }} -type d -exec chmod 755 {} +; \
   fi; \
   # Ensure settings.local.php exists and is owned by www-data
-  install -o www-data -g www-data -m 640 /dev/null /opt/drupal/web/sites/default/settings.local.php
+  install -o www-data -g www-data -m 640 /dev/null {{ DRUPAL_DOCKER_HTML_PATH }}/sites/default/settings.local.php
 
 # -------------------------------------------------------------------
 # Runtime defaults
 # -------------------------------------------------------------------
 USER www-data
-WORKDIR /var/www/html  # symlink pointing to /opt/drupal/web
+WORKDIR /var/www/html  # symlink pointing to {{ DRUPAL_DOCKER_HTML_PATH }}
 
 # -------------------------------------------------------------------
 # Build-time check (optional)

roles/web-app-drupal/templates/docker-compose.yml.j2

@@ -7,7 +7,7 @@
     ports:
       - "127.0.0.1:{{ ports.localhost.http[application_id] }}:80"
     volumes:
-      - data:/var/www/html/web/sites/default/files
+      - data:{{ DRUPAL_DOCKER_HTML_PATH }}/sites/default/files
       - {{ DRUPAL_MSMTP_ABS }}:/etc/msmtprc
       - {{ DRUPAL_SETTINGS_LOCAL_ABS }}:{{ DRUPAL_DOCKER_CONF_PATH }}/settings.local.php
 

roles/web-app-drupal/vars/main.yml

@@ -7,8 +7,8 @@ database_type:                "mariadb"
 
 DRUPAL_URL:                   "{{ domains | get_url(application_id, WEB_PROTOCOL) }}"
 DRUPAL_CUSTOM_IMAGE:          "drupal_custom"
-DRUPAL_DOCKER_HTML_PATH:      "/var/www/html"
-DRUPAL_DOCKER_CONF_PATH:      "/var/www/html/sites/default"
+DRUPAL_DOCKER_HTML_PATH:      "/opt/drupal/web"
+DRUPAL_DOCKER_CONF_PATH:      "{{ DRUPAL_DOCKER_HTML_PATH }}/sites/default"
 DRUPAL_VERSION:               "{{ applications | get_app_conf(application_id, 'docker.services.drupal.version') }}"
 DRUPAL_IMAGE:                 "{{ applications | get_app_conf(application_id, 'docker.services.drupal.image') }}"
 DRUPAL_CONTAINER:             "{{ applications | get_app_conf(application_id, 'docker.services.drupal.name') }}"