Grégoire Pineau

The Symfony Workflow demo got a new look

Thu, 05 Nov 2026 00:00:00 +0000

In April 2016, I created a small application for SymfonyLive Paris, to show the new Workflow component. Ten years later, the demo is still online. And it just got a new look.

Why now? I was fed up with the ugly old style.

What about the style?

The new theme is green, with dark bands. And the diagrams now look like Petri nets, the model behind the Workflow component: black transitions, and marked places in lime.

Bootstrap 5.3.8 and Mermaid come from AssetMapper instead of a CDN. But Mermaid has a funny side effect: its single-file build is not an ES module, so it adds about 125 entries to importmap.php (d3, cytoscape…).

That’s why it only loads on the pages that show a diagram.

What’s new in the demo?

Applying a transition doesn’t reload the page anymore. Turbo morphs it and keeps the scroll. And a small Stimulus controller keeps the diagram on screen until the new one is drawn, so it never goes blank.

But Turbo prefetches the links you hover. And in this demo, logging in and out are GET requests. So just hovering a link would log you in 😅. That’s why Turbo doesn’t prefetch these two links.

The show pages now list the transitions with the guards that block them. And the history shows the last 5 transitions, instead of the first 5.

What about Symfony 8.2?

The demo runs on Symfony 8.2.0-BETA1, and it uses what’s new.

You can now define a workflow in a class, with PHP attributes. Here is a simplified version of the article workflow:

#[AsWorkflow(type: WorkflowType::Workflow, supports: Article::class)]
class ArticleWorkflow
{
 use WorkflowTrait;

 #[Place(initial: true)]
 public const string DRAFT = 'draft';

 #[Transition(
 from: self::DRAFT,
 to: [self::WAITING_FOR_JOURNALIST, self::WAIT_FOR_SPELLCHECKER],
 guard: 'is_fully_authenticated()',
 )]
 public const string REQUEST_REVIEW = 'request review';
}

The demo also has five small workflows in YAML, with no class behind them. But a workflow needed a supports key, so I had to write this:

framework:
 workflows:
 straight:
 type: workflow
 supports:
 - stdClass # Just a hack

With 8.2, supports is optional, and workflows have their own root key:

workflow:
 straight:
 type: workflow

The homepage lost its controller too, thanks to the new template key of the routes:

homepage:
 path: /
 template: homepage/index.html.twig

And bin/console lint:expressions now checks the guards of the workflows in the CI.

Conclusion

Go play with the demo. Connect as a journalist, apply a transition, and see what happens. And the code is on GitHub.

What's new in private-stuff, my emergency website

Wed, 28 Oct 2026 00:00:00 +0000

If I lose my phone while traveling, I still need my 2FA recovery codes, my documents and my contacts. That’s why I built private-stuff in 2024: a static website with everything I may need in an emergency.

It got a big update this autumn: a new theme, a safer deployment, and above all a way to share a secret with people you trust.

The whole site sits behind a password, and the recovery codes are also encrypted with staticrypt. You can see a demo with dummy data.

What changed on the website?

The site has a new “night light” theme: always dark and warmer, with big Call and Email buttons on the emergency contacts.

The project now has two modes. dev, the default, uses dummy data and forbids the deployment. prod uses my real data, and the secrets live in a file which is only loaded in this mode. So they can’t leak into a dev build.

The encrypt and decrypt tasks now use the native functions of Castor, instead of my hand-written libsodium code.

What went wrong with the deployment?

The real site is on Cloudflare Pages, with a password in front of it. But deploying from another git branch created a preview deployment, which doesn’t get the production secrets. So the password was empty, and the middleware let everyone in.

Now castor deploy always deploys to the production branch. And after the deployment, it checks that the site really asks for a password. If not, the task fails.

The password itself was also sent with a shell echo, which exposed it on the command line and in the error output of Castor. It now goes on stdin.

Some things are too sensitive for this website, like a main password or bank accounts. But the people close to you must be able to reach them if something really bad happens.

You could give the password to one person. But then you trust one person, and everything that can happen to this person’s laptop. You could also cut it in two halves. But each half reveals a part of the password, and if one half is lost, the password is lost too.

That’s what Shamir’s secret sharing solves. You split a secret into N pieces, and you choose a threshold K. Any K pieces give the secret, and fewer give nothing.

How can a piece reveal nothing?

Let’s take a threshold of 2. Draw a line on a graph, and put your secret where the line crosses the vertical axis. Then give each person a different point of this line.

Two points define a line. So two people can draw it, and read the secret. But one point is not enough: an infinity of lines go through it, and they can cross the axis anywhere. So one piece says nothing about the secret. Not “almost nothing”: nothing.

With a threshold of 3, you use a parabola, which needs three points. And so on.

Note: the real implementation works on bytes, in a finite field (GF(2⁸)), not on a graph. But the idea is the same.

How do you seal a document?

ReMemory does the crypto, and private-stuff wraps it in Castor tasks.

First, you write your document in Markdown, in data/shamir.md. Then you list the people in data/shamir.yaml:

threshold: 2
language: fr

holders:
 - name: John Doe
 contact: "+1234567890"
 - name: Jane Smith
 contact: janesmith@example.com
 - name: Bob

You check the document, and you seal it:

castor shamir:preview
castor shamir:seal

The task renders the document as an HTML page with no external assets, because it may be opened offline, years later. Then ReMemory encrypts it with age and a random passphrase, and splits this passphrase with Shamir:

document ──► encrypted with age ──► the same in every bundle
passphrase ──► split in N pieces ──► one piece per bundle

Each person gets a ZIP bundle, with a recover.html page, and a printable README.pdf with the instructions, their piece and the contact list.

You send each bundle to its holder, then you delete var/shamir/. Together, these bundles open the document, so they must not stay in one place.

If the threshold equals the number of people, the task warns you: a single lost bundle, and nobody can open the document.

How do they open it?

A holder opens recover.html in any browser, offline, with nothing to install. Their own piece is already loaded. They add the bundles of the other holders, until the threshold is reached, and the document opens.

It doesn’t depend on ReMemory anymore: the page is self-contained, and it still works if the project disappears.

But any K holders can open the document, without asking you. So choose the people and the threshold carefully.

And if you seal the document again, it creates a new key. The old bundles can’t open the new document, so you have to send the new bundles to everyone.

Is ReMemory safe?

I ran a security audit of ReMemory, with the security audit skill from Cloudflare. It took about 4 hours. Then I shared the results with José Albornoz, its author, and he patched the library quickly. Thanks José!

There was nothing serious. But one finding is a nice illustration of the line above. The secret is the point at x = 0, so nobody ever gets a piece there. And the recovery didn’t check it. With a fake piece at x = 0, the line goes through this point, whatever the other pieces are, so whoever wrote the fake piece chooses the result. They can’t learn your real secret, but they could make someone open their files instead of yours.

ReMemory now refuses these pieces, and the existing bundles keep working.

Conclusion

The code is on GitHub, and the README explains how to build your own, with your own data. And you can try the recovery with the demo bundles of ReMemory.

The Messenger and Mercure demo got a big update

Wed, 21 Oct 2026 00:00:00 +0000

For SymfonyLive Paris 2025, I gave a talk about async with Messenger and Mercure, and I built a demo for it. A year and a half later, this demo got a big update: Symfony 8.1, FrankenPHP and Mercure 1.0.

Why now? I was fed up with the ugly UI, the demo was getting old, and Mercure 1.0 had just come out.

What does the demo do?

You upload a CSV of first names, and you compare three ways to import it:

Sync: the import runs during the HTTP request, and the browser waits
Async, no feedback: a worker does the job, the response is instant, but you have no clue about the progress
Async, with feedback: same thing, but the worker publishes its progress on Mercure, and the page is updated in real time

No polling involved. The worker renders a Twig block, and it publishes the result:

$content = $this->twig->load('csv/async.html.twig')->renderBlock('status', [
 // ...
]);

$this->mercurePublisher->publish(new Update("csv:{$importId}", $content));

And the page subscribes to it with one line:

{{ turbo_stream_from('csv:' ~ importId) }}

This is new too. turbo_stream_listen() is deprecated since UX Turbo 3.1, so I moved to turbo_stream_from().

Note: a Messenger worker keeps the code it started with. So restart it after a composer install, or your imports will fail with Unknown "turbo_stream_from" function.

What changed?

The demo now has a home page, with the three modes, and it runs on Symfony 8.1. The Docker stack comes from docker-starter, with FrankenPHP, which embeds the Mercure hub.

It also got a PHPUnit test suite and a CI. And I fixed two bugs along the way: submitting the form without a file was a 500 error, and a service was named deabug.log_processor.

Cherry on top: castor media drives a real headless Chromium, with Playwright PHP, to regenerate the screenshot and the GIF of this article.

What about Mercure 1.0?

FrankenPHP 1.13 embeds the Mercure 1.0 hub, and mercure-bundle 0.6 speaks protocol 1.0 by default. So both sides must move together.

The main change is about the JWT tokens: the hub now only trusts the tokens of a known issuer. So the Caddyfile, which configures the hub, looks like this:

issuer {$MERCURE_JWT_ISSUER} {
 publisher {
 jwt {env.MERCURE_PUBLISHER_JWT_KEY} {env.MERCURE_PUBLISHER_JWT_ALG}
 }
 subscriber {
 jwt {env.MERCURE_SUBSCRIBER_JWT_KEY} {env.MERCURE_SUBSCRIBER_JWT_ALG}
 }
}

These are environment variables, set in the docker-compose.yml of the demo:

MERCURE_JWT_ISSUER is a name you choose for the issuer of your tokens. The demo uses its own URL, https://async-messenger-mercure.test
MERCURE_PUBLISHER_JWT_KEY and MERCURE_SUBSCRIBER_JWT_KEY are the secrets used to sign the tokens. Use your own secrets, not the ones of the demo
MERCURE_PUBLISHER_JWT_ALG and MERCURE_SUBSCRIBER_JWT_ALG are the signing algorithms. The demo doesn’t set them, so the hub uses its default, HS256

Symfony signs the tokens, so it needs the same issuer, in the iss claim:

mercure:
 hubs:
 default:
 jwt:
 claims:
 iss: '%env(MERCURE_JWT_ISSUER)%'

But wait, there is a trap. The demo and ui options of the Caddyfile, which enabled the debug interface of the hub, are gone. So I replaced them with playground.

The problem is that FrankenPHP serves the hub and the application on the same site. And the playground redirects / to the debug interface. So when I opened the demo, I no longer saw the home page of the application, but the debug interface of Mercure 😅.

The fix is to use debugger instead. It serves the debug interface at /.well-known/mercure/debug/, and it leaves / to the application.

Conclusion

The demo runs on your machine, you only need Docker and Castor:

castor start

The code is on GitHub, and the slides are on Speaker Deck.

How to convert emoji with PHP, in your browser

Wed, 21 Oct 2026 00:00:00 +0000

I maintain symfony/emoji, and I thought it would be hilarious to build something with it in WebAssembly. So here is Emoji Converter. It turns 🐘 into :elephant: and back, with a whole PHP interpreter running in your browser.

Is it a joke?

Mostly 😁. symfony/emoji converts your text with a good old strtr(), and I ship 8 MB of WebAssembly to call it.

But it works. And it’s fast: a few milliseconds per conversion, PHP boot included.

What does it do?

It converts emoji to shortcodes (GitHub, GitLab, Slack, text), to their names in 136 languages, or to nothing at all. And it converts them back. There is no server, so your text never leaves the tab.

The PHP part is a thin layer over symfony/emoji:

$converter = new EmojiConverter();

$converter->fromEmoji('github', 'Hello 👋 🐘'); // Hello :wave: :elephant:
$converter->fromEmoji('fr', 'Hello 👋 🐘'); // Hello signe de la main éléphant
$converter->toEmoji('slack', 'Hello :wave: :elephant:'); // Hello 👋 🐘

But symfony/emoji only converts shortcodes back to emoji. Names are ordinary words, so a simple strtr() would also replace them inside other words. In French, “chat” (cat) is also in “achat” (purchase).

So the converter replaces whole words only, and it prefers the longest name:

$converter->toEmoji('fr', 'Un chat noir, pas un achat'); // Un 🐈‍⬛, pas un achat

How does it work?

PHP 8.5 is compiled with Emscripten by php-wasm-builder, and the application is embedded in the build.

For each conversion, the page runs a small PHP script. The request goes on stdin, and the result comes back on stdout, as JSON:

$request = json_decode(file_get_contents('php://stdin'), true, flags: \JSON_THROW_ON_ERROR);

$converter = new EmojiConverter();

// ...

echo json_encode($result, \JSON_THROW_ON_ERROR);

PHP is started and shut down on each conversion. Yes, like CGI.

What was the hard part?

Not the emoji. The hard part was the intl extension, because symfony/emoji needs the \Transliterator class.

You can’t just load an intl.so: dlopen() compiles WebAssembly synchronously, and Chrome refuses that on the main thread. So ICU is statically linked in the binary.

Then there is the size. The ICU data weighs about 30 MB, and the catalogs of symfony/emoji about 37 MB. So I don’t ship the ICU data at all: everything else that needs it (Collator, NumberFormatter…) fails. And the page only fetches the catalogs it needs.

Note: Fibers and proc_open() don’t work either. Emscripten does not provide the functions they rely on.

Conclusion

Is it useful? Not really. But I had fun, and it was a good excuse to build PHP with intl for the browser. Try it, and the code is on GitHub.

La raclette est-elle de gauche ou de droite ?

Thu, 08 Oct 2026 00:00:00 +0000

Vous tapez n’importe quoi (« la raclette », « le vélo », « Chateaubriand »), et une IA vous dit si c’est de gauche ou de droite. C’est De gauche ou de droite ?, un clone du site de Théo Delemazure, avec une différence : le modèle tourne entièrement dans votre navigateur. Il n’y a ni serveur ni API.

L’IA a été entraînée sur des clichés, donc à ne pas prendre au sérieux.

Comment c’est parti ?

Je voulais tester Jev, un nouveau modèle de TypeSafe AI, dans une page statique. Jev ne génère pas de texte : il renvoie une décision et un score de confiance. Exactement ce qu’il me fallait.

Mais Jev est propriétaire, et accessible seulement par API. Impossible de le faire tourner dans un navigateur.

J’ai donc gardé l’idée et la page statique, et j’ai remplacé Jev par un classifieur fait maison.

Pourquoi pas un petit LLM ?

La première idée, c’est un petit LLM open source dans le navigateur. Mais c’est un giga ou plus à télécharger, il est médiocre en français à cette taille, et surtout, un LLM, ça discute. On lui demande « gauche ou droite ? », il répond « alors, c’est une question complexe… ». Moi, je voulais un modèle qui décide.

Un modèle d’embeddings fait un seul passage sur la phrase, là où un LLM génère sa réponse mot par mot :

"le vélo" ──► modèle d'embeddings ──► vecteur ──► régression logistique ──► 72 % gauche

Le modèle d’embeddings ne sait rien de la politique, il représente seulement le sens d’un texte. Ensuite, une régression logistique, entraînée sur 972 exemples étiquetés, trouve quelle direction veut dire gauche, et laquelle veut dire droite.

Est-ce que plus d’exemples, ça aide ?

Pas vraiment. Je suis passé de 253 exemples à 952, et la précision n’est passée que de 66-68 % à 68,7 %. J’ai tout mesuré avec une validation croisée : on cache 1/5 des exemples, on entraîne sur le reste, et on mesure sur la partie cachée.

Les nouveaux exemples ont quand même corrigé des cas gênants. Avant, « facho » était de gauche à 84 %.

Le vrai goulot d’étranglement, c’était le modèle. J’ai donc monté un banc d’essai avec 11 modèles d’embeddings. EmbeddingGemma (197 Mo) atteint 81-82 %, contre 70,6 % pour la première version avec multilingual-e5-small. Dans le vrai pipeline, il donne 79 %.

Le résultat le plus drôle vient de Qwen3-Embedding. Son vecteur est calculé à partir du dernier mot de la phrase. Si le texte se termine par « votent pour », la précision passe donc de 80 % à 89 %. Du prompt engineering, pour un embedding ! Mais il pèse 614 Mo.

Et le zero-shot, qui compare le texte à « de gauche » et « de droite » sans aucun entraînement, donne 48 à 60 %. Pas mieux que le hasard. Il faut dire que « de droite », c’est aussi… le côté droit.

Quel classifieur choisir ?

Une fois le modèle d’embeddings choisi, il reste à décider qui tranche. J’ai donc monté un second banc d’essai : 12 classifieurs entraînés sur les embeddings des 972 exemples, avec les mêmes découpages pour tous.

Le SVM à noyau RBF arrive en tête avec 81,8 %, contre 78,8 % pour la régression logistique du site. Aucun autre ne gagne 3 points.

Les modèles à arbres ne battent pas un modèle linéaire : Random Forest, XGBoost, CatBoost et LightGBM restent entre 77,6 % et 79,4 %. Dans un embedding, l’information est répartie sur des centaines de dimensions à la fois, alors qu’un arbre découpe une variable à la fois.

Réduire la dimension n’apporte rien non plus. La précision augmente avec le nombre de composantes gardées, et rejoint celle des 768 dimensions vers 512.

Le gain le moins cher vient de la régularisation. La régression du site apprend ses exemples par cœur : 99,9 % sur ceux qu’elle a vus, 78,8 % sur les autres. Avec une régularisation environ 40 fois plus forte (λ ≈ 0,4 au lieu de 0,01), elle passe à 80,0 %.

Mais attention à ne pas trop lire dans ces chiffres. Avec 972 exemples, la marge d’erreur sur une précision de 80 % est d’environ ±2,5 points. Un écart d’un point entre deux modèles ne veut donc rien dire.

Et le site ? Il garde sa régression logistique, avec λ = 0,01. Pourquoi ? Flemme de changer 😅.

Qu’est-ce qui a cassé dans le navigateur ?

La version q4 standard du modèle fonctionne dans Node, mais pas dans le navigateur. Elle utilise une opération (GatherBlockQuantized) que le moteur WebAssembly d’onnxruntime ne sait pas exécuter. L’entraînement et le site utilisent donc la variante model_no_gather_q4, pour obtenir les mêmes vecteurs des deux côtés.

Ensuite, la page gelait. Avec EmbeddingGemma, un calcul prend environ 1 seconde dans le navigateur, parce que GitHub Pages ne peut pas envoyer les en-têtes COOP/COEP qui autorisent plusieurs cœurs. Une option déplace ce calcul dans un Web Worker :

env.backends.onnx.wasm.proxy = true;

Et envoyer le formulaire pendant le téléchargement rechargeait la page, ce qui relançait les 200 Mo 😅. Le formulaire est donc verrouillé tant que le modèle n’est pas prêt.

Qu’a appris le modèle ?

Le nuage des exemples permet de le voir. Chaque point est un des 972 exemples : EmbeddingGemma le transforme en vecteur de 768 nombres, puis t-SNE ramène ces vecteurs sur un plan, en gardant ensemble les textes de sens proche.

La question est la suivante : avant même qu’on lui apprenne quoi que ce soit, le modèle range-t-il la gauche d’un côté et la droite de l’autre ?

Pas vraiment. La carte est rangée par thème, pas par camp. Les personnalités sont ensemble, les lieux ensemble, la nourriture ensemble, et on trouve les deux couleurs dans chaque thème. Le modèle a d’abord appris de quoi parle un texte. Le camp n’arrive qu’en second.

Mais dans un thème, le camp se voit parfois très bien. Les 8 plus proches voisins de « la Rolex » sont tous étiquetés à droite : montre suisse, Porsche, sac Louis Vuitton… Ceux des « vêtements de seconde main » sont surtout à gauche : friperie, Vinted, tote bag. Sur les modes de vie, les clichés sont déjà dans les vecteurs.

Ça coince sur les prises de position. Le modèle se trompe sur 30 % des exemples de fiscalité et d’immigration, contre 10 % pour les partis et les étiquettes. Un embedding dit de quoi on parle, pas si on est pour ou contre : le plus proche voisin de « la loi anti-squat », c’est « le squat ».

C’est aussi pour ça que le nuage paraît mélangé, malgré 79 % de bonnes réponses. Parmi les 10 plus proches voisins d’un exemple, seuls 65 % ont la même étiquette. La régression, elle, cherche une seule direction « gauche → droite » qui traverse tous les thèmes. C’est elle qui fait la différence.

Conclusion

Essayez-le. La première visite télécharge environ 200 Mo, ensuite le modèle reste en cache. Tout est expliqué dans le README et dans les slides de mon lightning talk.

Faut-il emprunter sur 15 ou 25 ans ?

Tue, 06 Oct 2026 00:00:00 +0000

Avec un pote, on a le même débat à chaque fois : pour acheter un logement en France, faut-il emprunter sur la durée la plus courte possible, ou la plus longue ? J’ai donc demandé à Claude de répondre avec de vrais chiffres : Court ou long ?. L’étude est livrée avec un simulateur.

Pour être honnête, cette étude sert à 90 % à ce débat, et à 10 % à jouer avec Claude, pour montrer qu’il sait bien compter. C’est Claude qui a tout construit.

Note : ce n’est pas un conseil financier personnalisé. Les chiffres utilisent les taux moyens d’octobre 2026.

Combien coûte vraiment un prêt long ?

Prenons 250 000 € sur 15 ou 25 ans, à 3,50 % et 3,75 %, avec une assurance à 0,30 % sur le capital initial.

Le prêt sur 25 ans affiche 3,75 %. Mais passer de 15 à 25 ans, c’est comme recevoir 502 € par mois pendant 15 ans, puis rembourser 1 348 € par mois pendant 10 ans de plus. Et ce prêt caché a un vrai taux : 4,68 % par an.

C’est plus que 3,75 %, pour deux raisons. Le taux sur 25 ans s’applique à tout le capital, et l’assurance court dix ans de plus.

La vraie question, c’est donc : que deviennent les 502 € libérés chaque mois ?

Et si on place la différence ?

Vous avez sûrement déjà entendu cet argument : « Avec un prêt long, on garde plus d’argent, et on peut le placer à 8 %. »

Avec 8 % garantis dans un PEA, le prêt long gagne : après 25 ans, vous avez 70 408 € de plus, frais et prélèvements sociaux compris.

Mais 8 %, ce n’est qu’une moyenne. L’étude simule donc 4 000 marchés, avec une volatilité de 15 %. Le prêt long gagne dans 74 % des cas. Dans 1 cas sur 10, il perd plus de 48 000 €. Dans 1 cas sur 10, il gagne plus de 366 000 €.

Et ça ne marche que si vous gardez le logement. Si vous revendez au bout de 8 ans, c’est presque pile ou face : 52 %. Et avec le rendement du MSCI World en euros depuis 2000 (6,67 % par an), le prêt long ne gagne que dans 62 % des cas après 25 ans.

Alors, court ou long ?

Le court par défaut, le long si vous investissez vraiment.

Le court gagne si l’argent libéré irait sur un livret ou un fonds euros, ou s’il serait dépensé. Il gagne aussi si vous risquez de revendre dans les 10 ans, ou si votre assurance est chère.

Le long gagne si vous placez réellement la différence en actions chaque mois, pendant toute la durée, sans vendre pendant les krachs. Il gagne aussi en investissement locatif, où les intérêts se déduisent, ou quand c’est la seule durée qui rend l’achat possible.

Conclusion

L’étude parle aussi de fiscalité, d’inflation, de renégociation et de retraite, avec 34 sources. Le simulateur permet de tester votre propre cas, et les réglages sont enregistrés dans l’URL.

Tout tient dans un seul fichier HTML, et tous les calculs se font dans votre navigateur. Si vous trouvez un chiffre faux, ouvrez une issue, avec une source si possible.

consul-php-sdk 5.4 covers the whole Consul API

Tue, 29 Sep 2026 00:00:00 +0000

I started consul-php-sdk in November 2014. Almost twelve years later, version 5.4 finally covers the whole Consul CE HTTP API: it went from 6 services to 17, and from 34 public methods to 141.

Why now? I don’t use Consul in production anymore, but I have an Ultra Claude plan to do open source.

What is consul-php-sdk?

It’s a thin PHP wrapper around the Consul HTTP API, built on top of Symfony HttpClient. No magic here:

$kv = new Consul\Services\KV();

$kv->put('config/feature-flag', 'enabled');

echo $kv->get('config/feature-flag', ['raw' => true])->getBody(); // enabled

Until now, it covered Agent, Catalog, Health, KV, Session and TXN. So you had the key/value store and the service discovery. For anything else, you were on your own.

Version 5.4 adds 11 services. Let’s see some of them.

How to back up a cluster?

Snapshot saves the whole state of your cluster, and restores it:

$snapshot = new Consul\Services\Snapshot();

file_put_contents('backup.snap', $snapshot->save()->getBody());

// Later...
$snapshot->restore(file_get_contents('backup.snap'));

How to manage ACLs?

ACL handles the tokens, the policies and the roles. For example, to create a token that can only read your configuration:

$acl = new Consul\Services\ACL();

$policy = $acl->createPolicy([
 'Name' => 'read-config',
 'Rules' => 'key_prefix "config/" { policy = "read" }',
])->json();

$token = $acl->createToken([
 'Description' => 'Read the configuration',
 'Policies' => [['ID' => $policy['ID']]],
])->json();

echo $token['SecretID'];

How to query your services?

PreparedQuery stores a query in Consul, and you run it by its name:

$query = new Consul\Services\PreparedQuery();

$query->create([
 'Name' => 'api',
 'Service' => ['Service' => 'api', 'OnlyPassing' => true],
]);

$nodes = $query->execute('api')->json()['Nodes'];

What about the service mesh?

Connect manages the intentions, and Config the configuration entries:

$connect = new Consul\Services\Connect();

$connect->upsertIntention('web', 'api', ['Action' => 'allow']);

$connect->checkIntention('web', 'api')->json(); // ['Allowed' => true]

$config = new Consul\Services\Config();

$config->apply(['Kind' => 'service-defaults', 'Name' => 'api', 'Protocol' => 'http']);

And the rest?

Event fires custom events through your cluster:

$event = new Consul\Services\Event();

$event->fire('deploy', 'v1.2.3');

Status gives you the leader and the peers, and Operator covers Raft, Autopilot and the keyring. Coordinate, DiscoveryChain and Peering complete the list.

And Agent, Catalog and Health got all their missing endpoints.

What else changed?

All the documented options are now allowed: blocking queries, consistency modes, filtering, and so on. Before, an option missing from the list of a method was silently dropped. And you can pass many values for an option:

$health = new Consul\Services\Health();

$health->service('api', ['tag' => ['v1', 'primary']]);

The dc option now works on all endpoints that are not local to the agent. And the ACL token can be read from the CONSUL_HTTP_TOKEN environment variable, like the Consul CLI does.

I also fixed a few bugs:

MultiSemaphore reused the metadata of a previous resource when acquiring many resources
Session::create(), and so LockHandler, failed when called without arguments
Agent::join() and Agent::forceLeave() used GET instead of PUT

How to upgrade?

Version 5.4 requires PHP 8.2, Symfony HttpClient 6.4, 7.4 or 8.1+, and psr/log 2 or 3.

Conclusion

The library stays thin: it still only depends on symfony/http-client and psr/log. But now, if Consul can do it, you can do it from PHP.

The Symfony observability demo got a refresh

Sun, 30 Aug 2026 00:00:00 +0000

I just wanted to give my observability demo a little refresh. It ended up with 84 files changed, 6,743 new lines, and Symfony going from 7.0 to 8.1 😅.

What is this demo?

It’s a small Symfony application I built for a talk about logs (in French). It shows how to configure Monolog, and what a real observability stack looks like around it.

Every log record goes to Vector, which fans it out to ClickHouse, Elasticsearch and Loki. And each one comes with its own tool: Redash, Kibana and Grafana.

The Monolog part is really short:

monolog:
 handlers:
 syslog:
 type: syslogudp
 host: vector
 port: 9000
 formatter: monolog.formatter.json
 channels: ["!event"]

What changed?

The application now runs on Symfony 8.1, and the Docker stack comes from docker-starter. It got a Bootstrap frontend with AssetMapper, so no Node. It also got tests and a CI.

And castor start now provisions a dashboard in Kibana, Grafana and Redash. So the links of the homepage show real data, instead of an empty tool.

How to fill a dashboard?

A dashboard needs data. But if you generate 600 logs with one click, they all land at the same time, and you get a single spike. Not very realistic.

So the “Generate logs” button now asks for a tempo: right now, the last 30 minutes, the last hour, or the last 6 hours. And the logs are backdated, with a small Monolog processor:

public function __invoke(LogRecord $record): LogRecord
{
 $backdateTo = $record->context['backdate_to'] ?? null;

 if (!$backdateTo instanceof \DateTimeImmutable) {
 return $record;
 }

 $context = $record->context;
 unset($context['backdate_to']);

 return $record->with(datetime: $backdateTo, context: $context);
}

But wait. Vector has to use the date of the record, instead of the time it received it:

.timestamp = parse_timestamp(.datetime, format: "%+") ?? now()

And Loki doesn’t like out-of-order entries. So the generator emits the oldest logs first. And Vector must let them go, instead of silently dropping them:

loki:
 out_of_order_action: accept

Conclusion

The demo runs on your machine, you only need Docker and Castor:

castor start

The first start takes a few minutes. Then click on “Generate logs”, and open a dashboard.

The code is on GitHub, and the slides are on Speaker Deck.

How to compare two composer.lock files

Wed, 09 Apr 2025 00:00:00 +0000

I was upgrading an application, and keeping track of the dependencies was a real mess. The raw diff of a big JSON file is not the best way to see what really changed between two composer.lock files.

So I built Composer Lock Comparison. You paste two composer.lock, and you get a beautiful diff.

How does it work?

Go to lyrixx.github.io/composer-diff. Paste the old file on the left, the new one on the right, and click on “Compare Files”. No file at hand? Click on “Load examples”.

You get one table for your packages, and another one for your dev packages. For each package, you can see the operation (upgrade, downgrade, install or remove), the versions, the license, and a link to the diff of the package between the two versions.

And there is a Markdown version of the result, so you can paste it in a pull request:

| Prod Packages | Operation | Base | Target |
|-----------------------------------------------------------|-----------|-------|--------|
| [composer/composer](https://github.com/composer/composer) | Upgraded | 2.8.0 | 2.8.8 |
| [marc-mabe/php-enum](https://github.com/marc-mabe/php-enum) | New | - | v4.7.1 |

Where does my composer.lock go?

Nowhere. The website is a static page on GitHub Pages, and there is no server behind it.

PHP is compiled to WebAssembly and runs in your browser. So your composer.lock never leaves the tab, and you can use it with your private packages.

How is it made?

The code is really small, because the hard work is done by others. The comparison comes from IonBazan/composer-diff:

$prodOperations = $this->packageDiff->getDiff(
 $this->packageDiff->loadPackagesFromArray($oldLock, false, false),
 $this->packageDiff->loadPackagesFromArray($newLock, false, false)
);

And soyuka/php-wasm showed the way to run PHP in the browser. Thanks to both of them!

Conclusion

Next time you review a composer update, give it a try. And the code is on GitHub.

Grégoire Pineau

The Symfony Workflow demo got a new look

What about the style?

What’s new in the demo?

What about Symfony 8.2?

Conclusion

What's new in private-stuff, my emergency website

What changed on the website?

What went wrong with the deployment?

How to share a secret?

How can a piece reveal nothing?

How do you seal a document?

How do they open it?

Is ReMemory safe?

Conclusion

The Messenger and Mercure demo got a big update

What does the demo do?

What changed?

What about Mercure 1.0?

Conclusion

How to convert emoji with PHP, in your browser

Is it a joke?

What does it do?

How does it work?

What was the hard part?

Conclusion

La raclette est-elle de gauche ou de droite ?

Comment c’est parti ?

Pourquoi pas un petit LLM ?

Est-ce que plus d’exemples, ça aide ?

Quel classifieur choisir ?

Qu’est-ce qui a cassé dans le navigateur ?

Qu’a appris le modèle ?

Conclusion

Faut-il emprunter sur 15 ou 25 ans ?

Combien coûte vraiment un prêt long ?

Et si on place la différence ?

Alors, court ou long ?

Conclusion

consul-php-sdk 5.4 covers the whole Consul API

What is consul-php-sdk?

How to back up a cluster?

How to manage ACLs?

How to query your services?

What about the service mesh?

And the rest?

What else changed?

How to upgrade?

Conclusion

The Symfony observability demo got a refresh

What is this demo?

What changed?

How to fill a dashboard?

Conclusion

How to compare two composer.lock files

How does it work?

Where does my composer.lock go?

How is it made?

Conclusion