[minor] Harden ISLE template lifecycle

.dockerignore

@@ -1,7 +1,12 @@
 .git
+.github
+.DS_Store
 .cache
+.env*
 certs
 secrets
+backups/
+acme.json
 vendor
 web/core
 web/modules/contrib

.github/workflows/sitectl-create-smoke-test.yaml

@@ -0,0 +1,34 @@
+name: sitectl-create-smoke-test
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sitectl-create-smoke-test-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  create:
+    name: sitectl create isle ${{ matrix.create_definition }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - create_definition: default
+            create_args: >-
+              --fcrepo off
+              --blazegraph off
+              --isle-file-system-uri private
+              --iiif triplet
+              --iiif-topology disabled
+              --bot-mitigation off
+    uses: libops/.github/.github/workflows/sitectl-create-smoke-test.yaml@8f2eb98981e477cb8ac65d24c6fe06f45e31159c # main
+    with:
+      plugin: isle
+      create-definition: ${{ matrix.create_definition }}
+      create-args: ${{ matrix.create_args }}

.gitignore

@@ -1,6 +1,12 @@
-.env
+.env*
 docker-compose.override.yml
 docker-compose.override.yaml
+certs/*
+!certs/.gitignore
+secrets/*
+!secrets/.gitignore
+backups/
+acme.json
 ./drupal/rootfs/var/www/drupal/vendor
 ./drupal/rootfs/var/www/drupal/web/core
 ./drupal/rootfs/var/www/drupal/web/modules/contrib

Dockerfile

@@ -1,6 +1,5 @@
-ARG REPOSITORY=libops
-ARG TAG=nginx-1.30.3-php84
-FROM ${REPOSITORY}/islandora:${TAG}
+ARG BASE_IMAGE=libops/islandora:nginx-1.30.3-php84
+FROM ${BASE_IMAGE}
 
 ARG TARGETARCH
 

README.md

@@ -31,7 +31,9 @@ The site is served through Traefik at `http://localhost` by default.
 
 ## Local image build
 
-The `drupal` service builds this checkout on top of the LibOps Islandora base image. The Dockerfile copies Composer lockfiles and assets before local recipes, modules, themes, config, and rootfs additions so Docker can reuse dependency layers when only site customizations change. Local builds use the platform selected by the Docker CLI and do not push images.
+The `drupal` service builds this checkout on top of the LibOps Islandora base image. The Dockerfile copies Composer lockfiles and assets before local recipes, modules, themes, config, and rootfs additions so Docker can reuse dependency layers when only site customizations change. During `sitectl create`, initialization prepares secrets, certificates, ownership, and rootfs permissions; the normal create build phase then builds the image once. Local builds use the platform selected by the Docker CLI and do not push images.
+
+Docker Compose derives the project name from the checkout directory, so independent forks do not share containers, networks, or named volumes by default. Set `COMPOSE_PROJECT_NAME` explicitly when a stable name is required. If an existing checkout previously relied on this template's fixed `isle-site-template` project name, set `COMPOSE_PROJECT_NAME=isle-site-template` before starting it to keep using its existing named volumes, or migrate those volumes deliberately.
 
 ## Basic Operations
 
@@ -50,18 +52,17 @@ sitectl healthcheck
 sitectl validate
 ```
 
-Update image tags or pin a full image reference with [`sitectl image`](https://sitectl.libops.io/commands/image):
+Update the application base tag or pin that base by digest with [`sitectl image`](https://sitectl.libops.io/commands/image):
 
 ```bash
-sitectl image set --tag drupal=nginx-1.30.3-php84 --tag solr=9 --tag alpaca=main
-sitectl image set --image drupal=libops/islandora:nginx-1.30.3-php84@sha256:...
+sitectl image set --tag drupal=nginx-1.30.3-php84 --tag solr=9 --tag alpaca=2.4
+sitectl image set --build-arg drupal.BASE_IMAGE=libops/islandora:nginx-1.30.3-php84@sha256:...
 ```
 
-Enable local development bind mounts with [`sitectl set`](https://sitectl.libops.io/commands/set), then apply the component change with [`sitectl converge`](https://sitectl.libops.io/commands/converge):
+Enable local development bind mounts with [`sitectl set`](https://sitectl.libops.io/commands/set):
 
 ```bash
 sitectl set dev-mode enabled
-sitectl converge
 ```
 
 Publish a domain, switch HTTP/TLS mode, configure Let's Encrypt, trust upstream proxies, or tune upload limits with the `ingress` component:
@@ -70,16 +71,16 @@ Publish a domain, switch HTTP/TLS mode, configure Let's Encrypt, trust upstream
 sitectl set ingress enabled --mode https-custom --domain islandora.localhost
 sitectl set ingress enabled --mode https-letsencrypt --domain islandora.example.org --acme-email ops@example.org
 sitectl set ingress enabled --trusted-ip 203.0.113.10/32 --max-upload-size 2G --upload-timeout 10m
-sitectl converge
 ```
 
+`sitectl set` applies the requested component change immediately. Use `sitectl converge` when you want an interactive review of the complete component state.
+
 The ingress component writes `INGRESS_HOSTNAMES` as comma-separated hostnames and `INGRESS_SCHEME` as `http` or `https` into the app container. Runtime config is rendered from those values during container startup, so generated sites should not carry separate app URL env vars for the same public route.
 
-Enable ISLE bot mitigation with [`sitectl set`](https://sitectl.libops.io/commands/set), then apply it with [`sitectl converge`](https://sitectl.libops.io/commands/converge):
+Enable ISLE bot mitigation with [`sitectl set`](https://sitectl.libops.io/commands/set):
 
 ```bash
 sitectl set bot-mitigation on
-sitectl converge
 ```
 
 See the [ISLE sitectl plugin docs](https://sitectl.libops.io/plugins/isle) for Fedora, Blazegraph, IIIF, derivative microservices, cache, sync, migration, ingress, and bot mitigation details.
@@ -107,6 +108,10 @@ This template starts from the upstream [ISLE Site Template](https://github.com/I
 - Cantaloupe replaced with Triplet.
 - LibOps images for the application services.
 
+Only MariaDB and the one-shot `database-init` service receive `DB_ROOT_PASSWORD`. The initializer idempotently creates the Drupal database and scoped user before the app starts; the long-running Drupal service receives only `DRUPAL_DEFAULT_DB_PASSWORD` as `DB_PASSWORD`. Optional components that need their own database follow the same scoped-credential boundary. Initialization also generates the dormant `TOMCAT_ADMIN_PASSWORD` credential so enabling Fedora later never falls back to a baked-in default.
+
+ActiveMQ, Alpaca, and Drupal share the generated `ACTIVEMQ_PASSWORD` through service-specific secret targets. Drupal receives it as `DRUPAL_DEFAULT_BROKER_PASSWORD` together with the non-secret `admin` broker username, so the rendered Islandora settings use authenticated STOMP rather than relying on a broker default.
+
 ## License
 
 The Docker Compose template and LibOps-specific setup in this repository are licensed under the MIT License. The upstream Islandora starter site is licensed separately under the GNU General Public License v2; see `LICENSE.islandora-starter-site`.

composer.json

@@ -41,14 +41,15 @@
         "drupal/config_update": "^2.0@alpha",
         "drupal/context": "^5@RC",
         "drupal/controlled_access_terms": "^2",
-        "drupal/core-composer-scaffold": "^11.1",
-        "drupal/core-recommended": "^11.1",
+        "drupal/core-composer-scaffold": "~11.3.0",
+        "drupal/core-recommended": "~11.3.0",
         "drupal/facets": "^2",
         "drupal/field_group": "^4",
         "drupal/field_permissions": "^1",
         "drupal/field_report": "^2.2",
         "drupal/flysystem": "^2.2@alpha",
         "drupal/fpa": "^4.0",
+        "drupal/geolocation": "^3.15",
         "drupal/hal": "^1.0||^2.0",
         "drupal/islandora": "^2.12.3",
         "drupal/islandora_mirador": "^2",
@@ -59,7 +60,7 @@
         "drupal/search_api_solr": "^4.2",
         "drupal/taxonomy_manager": "^2.0",
         "drupal/term_merge": "^2.0@beta",
-        "drupal/tour": "*",
+        "drupal/tour": "^2.0",
         "drupal/twig_tweak": "^3.2",
         "drupal/views_data_export": "^1.2",
         "drupal/views_field_view": "^1.0@beta",