From 4bc2d11f357493adb60c8fecd227c2492dc9604e Mon Sep 17 00:00:00 2001
From: George Dumitrescu <george@dumitres.co>
Date: Mon, 28 Sep 2026 10:05:37 +0300
Subject: [PATCH] feat: name phpMyAdmin's language cookie so a language picked
 in lerd wins

phpMyAdmin stores the language in pma_lang from the first page it serves and reads it ahead of Accept-Language, so a language picked in lerd only reached it until it had been opened once. The preset now names pma_lang and pma_lang_https under dashboard_locale_cookies, which lerd 1.36.0 holds back while a language is picked. The key is new in schema 2, so phpMyAdmin is authored there and the tree older binaries read keeps the preset they already have.
---
 schema/2.yaml                     |  2 +
 schema/2/services/index.json      |  6 +--
 schema/2/services/phpmyadmin.yaml | 72 +++++++++++++++++++++++++++
 services/index.json               |  6 +--
 services/phpmyadmin.yaml          | 81 ++++++++++++-------------------
 5 files changed, 112 insertions(+), 55 deletions(-)
 create mode 100644 schema/2/services/phpmyadmin.yaml

diff --git a/schema/2.yaml b/schema/2.yaml
index edd719b..68af76f 100644
--- a/schema/2.yaml
+++ b/schema/2.yaml
@@ -25,6 +25,8 @@ changes:
     downgrade: drop
   - path: dashboard_login
     downgrade: drop
+  - path: dashboard_locale_cookies
+    downgrade: drop
   - path: dashboard_proxy_at_path
     downgrade: drop
   - path: dashboard_proxy_keep_host
diff --git a/schema/2/services/index.json b/schema/2/services/index.json
index 520d462..9c2be64 100644
--- a/schema/2/services/index.json
+++ b/schema/2/services/index.json
@@ -221,9 +221,6 @@
       "name": "phpmyadmin",
       "description": "phpMyAdmin web UI for every installed lerd MySQL service",
       "dashboard": "http://localhost:8080",
-      "depends_on": [
-        "mysql"
-      ],
       "image": "docker.io/library/phpmyadmin:latest",
       "category": "admin",
       "icon": "database",
@@ -231,6 +228,9 @@
       "admin_for": [
         "mysql",
         "mariadb"
+      ],
+      "depends_on": [
+        "mysql"
       ]
     },
     {
diff --git a/schema/2/services/phpmyadmin.yaml b/schema/2/services/phpmyadmin.yaml
new file mode 100644
index 0000000..08301f4
--- /dev/null
+++ b/schema/2/services/phpmyadmin.yaml
@@ -0,0 +1,72 @@
+name: phpmyadmin
+image: docker.io/library/phpmyadmin:latest
+description: phpMyAdmin web UI for every installed lerd MySQL service
+ports:
+  - "8080:80"
+environment:
+  UPLOAD_LIMIT: 256M
+dynamic_env:
+  PMA_HOSTS: discover_family:mysql,mariadb
+  PMA_USERS: repeat_family:mysql,mariadb=root
+  PMA_PASSWORDS: repeat_family:mysql,mariadb=lerd
+depends_on:
+  - mysql
+dashboard: http://localhost:8080
+# The session cookie is dropped when the dashboard is framed from another
+# origin, so lerd-ui serves it same-origin under /_svc/phpmyadmin/ instead. Not
+# dashboard_external: the alias below only reaches the container on a restart
+# that regenerates its unit, which an older lerd does not do in the pass that
+# flips it to the proxy, so it would serve a 404 in between.
+dashboard_proxy: true
+# phpMyAdmin keeps the language in pma_lang from its first page on and reads it
+# ahead of Accept-Language, so a language picked in lerd would never reach it.
+dashboard_locale_cookies:
+  - pma_lang
+  - pma_lang_https
+files:
+  - target: /etc/apache2/conf-enabled/lerd-path-prefix.conf
+    content: |
+      Alias /_svc/phpmyadmin /var/www/html
+  - target: /etc/phpmyadmin/config.user.inc.php
+    content: |
+      <?php
+      // A lerd that does not know dashboard_proxy still frames this from its own
+      // origin, where SameSite=Strict drops the session cookie on every POST.
+      // SameSite=None needs Secure, which phpmyadmin only sets when isHttps()
+      // is true, hence the forced env var; browsers accept Secure on localhost.
+      // Served under the proxy mount the page is first-party and needs none of
+      // it, and that same isHttps() names the cookie __Secure-..._https and
+      // marks it secure, which a browser refuses over plain http. So the two
+      // apply to the requests that still arrive cross-origin, and stay until no
+      // supported lerd frames this that way.
+      if (strncmp($_SERVER['REQUEST_URI'] ?? '', '/_svc/phpmyadmin', 16) !== 0) {
+          $cfg['CookieSameSite'] = 'None';
+          $_SERVER['HTTPS'] = 'on';
+      }
+
+      // The official phpmyadmin image only handles PMA_USER/PMA_PASSWORD for
+      // single-host setups; in multi-host (PMA_HOSTS) it writes host/verbose
+      // per server but leaves user/password blank, forcing a login screen.
+      // Rebuild $cfg['Servers'] from our own parallel env arrays so every
+      // discovered mysql/mariadb service auto-logs in with config auth.
+      $hosts = array_values(array_filter(array_map('trim', explode(',', (string) getenv('PMA_HOSTS')))));
+      $users = array_map('trim', explode(',', (string) getenv('PMA_USERS')));
+      $passwords = array_map('trim', explode(',', (string) getenv('PMA_PASSWORDS')));
+      foreach ($hosts as $i => $host) {
+          $idx = $i + 1;
+          $cfg['Servers'][$idx] = [
+              'host'      => $host,
+              'verbose'   => $host,
+              'auth_type' => 'config',
+              'user'      => $users[$i] ?? 'root',
+              'password'  => $passwords[$i] ?? 'lerd',
+              'AllowNoPassword' => false,
+          ];
+      }
+      $cfg['AllowThirdPartyFraming'] = true;
+category: admin
+icon: database
+color: "#6c78af"
+admin_for:
+  - mysql
+  - mariadb
diff --git a/services/index.json b/services/index.json
index 9ba7d57..635ff1d 100644
--- a/services/index.json
+++ b/services/index.json
@@ -219,9 +219,6 @@
       "name": "phpmyadmin",
       "description": "phpMyAdmin web UI for every installed lerd MySQL service",
       "dashboard": "http://localhost:8080",
-      "depends_on": [
-        "mysql"
-      ],
       "image": "docker.io/library/phpmyadmin:latest",
       "category": "admin",
       "icon": "database",
@@ -229,6 +226,9 @@
       "admin_for": [
         "mysql",
         "mariadb"
+      ],
+      "depends_on": [
+        "mysql"
       ]
     },
     {
diff --git a/services/phpmyadmin.yaml b/services/phpmyadmin.yaml
index 1ed5010..17fecbc 100644
--- a/services/phpmyadmin.yaml
+++ b/services/phpmyadmin.yaml
@@ -2,7 +2,7 @@ name: phpmyadmin
 image: docker.io/library/phpmyadmin:latest
 description: phpMyAdmin web UI for every installed lerd MySQL service
 ports:
-  - "8080:80"
+- 8080:80
 environment:
   UPLOAD_LIMIT: 256M
 dynamic_env:
@@ -10,58 +10,41 @@ dynamic_env:
   PMA_USERS: repeat_family:mysql,mariadb=root
   PMA_PASSWORDS: repeat_family:mysql,mariadb=lerd
 depends_on:
-  - mysql
+- mysql
 dashboard: http://localhost:8080
-# The session cookie is dropped when the dashboard is framed from another
-# origin, so lerd-ui serves it same-origin under /_svc/phpmyadmin/ instead. Not
-# dashboard_external: the alias below only reaches the container on a restart
-# that regenerates its unit, which an older lerd does not do in the pass that
-# flips it to the proxy, so it would serve a 404 in between.
 dashboard_proxy: true
 files:
-  - target: /etc/apache2/conf-enabled/lerd-path-prefix.conf
-    content: |
-      Alias /_svc/phpmyadmin /var/www/html
-  - target: /etc/phpmyadmin/config.user.inc.php
-    content: |
-      <?php
-      // A lerd that does not know dashboard_proxy still frames this from its own
-      // origin, where SameSite=Strict drops the session cookie on every POST.
-      // SameSite=None needs Secure, which phpmyadmin only sets when isHttps()
-      // is true, hence the forced env var; browsers accept Secure on localhost.
-      // Served under the proxy mount the page is first-party and needs none of
-      // it, and that same isHttps() names the cookie __Secure-..._https and
-      // marks it secure, which a browser refuses over plain http. So the two
-      // apply to the requests that still arrive cross-origin, and stay until no
-      // supported lerd frames this that way.
-      if (strncmp($_SERVER['REQUEST_URI'] ?? '', '/_svc/phpmyadmin', 16) !== 0) {
-          $cfg['CookieSameSite'] = 'None';
-          $_SERVER['HTTPS'] = 'on';
-      }
+- target: /etc/apache2/conf-enabled/lerd-path-prefix.conf
+  content: 'Alias /_svc/phpmyadmin /var/www/html
 
-      // The official phpmyadmin image only handles PMA_USER/PMA_PASSWORD for
-      // single-host setups; in multi-host (PMA_HOSTS) it writes host/verbose
-      // per server but leaves user/password blank, forcing a login screen.
-      // Rebuild $cfg['Servers'] from our own parallel env arrays so every
-      // discovered mysql/mariadb service auto-logs in with config auth.
-      $hosts = array_values(array_filter(array_map('trim', explode(',', (string) getenv('PMA_HOSTS')))));
-      $users = array_map('trim', explode(',', (string) getenv('PMA_USERS')));
-      $passwords = array_map('trim', explode(',', (string) getenv('PMA_PASSWORDS')));
-      foreach ($hosts as $i => $host) {
-          $idx = $i + 1;
-          $cfg['Servers'][$idx] = [
-              'host'      => $host,
-              'verbose'   => $host,
-              'auth_type' => 'config',
-              'user'      => $users[$i] ?? 'root',
-              'password'  => $passwords[$i] ?? 'lerd',
-              'AllowNoPassword' => false,
-          ];
-      }
-      $cfg['AllowThirdPartyFraming'] = true;
+    '
+- target: /etc/phpmyadmin/config.user.inc.php
+  content: "<?php\n// A lerd that does not know dashboard_proxy still frames this\
+    \ from its own\n// origin, where SameSite=Strict drops the session cookie on every\
+    \ POST.\n// SameSite=None needs Secure, which phpmyadmin only sets when isHttps()\n\
+    // is true, hence the forced env var; browsers accept Secure on localhost.\n//\
+    \ Served under the proxy mount the page is first-party and needs none of\n// it,\
+    \ and that same isHttps() names the cookie __Secure-..._https and\n// marks it\
+    \ secure, which a browser refuses over plain http. So the two\n// apply to the\
+    \ requests that still arrive cross-origin, and stay until no\n// supported lerd\
+    \ frames this that way.\nif (strncmp($_SERVER['REQUEST_URI'] ?? '', '/_svc/phpmyadmin',\
+    \ 16) !== 0) {\n    $cfg['CookieSameSite'] = 'None';\n    $_SERVER['HTTPS'] =\
+    \ 'on';\n}\n\n// The official phpmyadmin image only handles PMA_USER/PMA_PASSWORD\
+    \ for\n// single-host setups; in multi-host (PMA_HOSTS) it writes host/verbose\n\
+    // per server but leaves user/password blank, forcing a login screen.\n// Rebuild\
+    \ $cfg['Servers'] from our own parallel env arrays so every\n// discovered mysql/mariadb\
+    \ service auto-logs in with config auth.\n$hosts = array_values(array_filter(array_map('trim',\
+    \ explode(',', (string) getenv('PMA_HOSTS')))));\n$users = array_map('trim', explode(',',\
+    \ (string) getenv('PMA_USERS')));\n$passwords = array_map('trim', explode(',',\
+    \ (string) getenv('PMA_PASSWORDS')));\nforeach ($hosts as $i => $host) {\n   \
+    \ $idx = $i + 1;\n    $cfg['Servers'][$idx] = [\n        'host'      => $host,\n\
+    \        'verbose'   => $host,\n        'auth_type' => 'config',\n        'user'\
+    \      => $users[$i] ?? 'root',\n        'password'  => $passwords[$i] ?? 'lerd',\n\
+    \        'AllowNoPassword' => false,\n    ];\n}\n$cfg['AllowThirdPartyFraming']\
+    \ = true;\n"
 category: admin
 icon: database
-color: "#6c78af"
+color: '#6c78af'
 admin_for:
-  - mysql
-  - mariadb
+- mysql
+- mariadb