This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

User Guide

This user guide is for project teams who are using the Drupal WxT distribution.

1 - General

Userguide for all of the general information related to the maintenance and operation of Drupal WxT.

1.1 - Overview

The Drupal WxT distribution is designed for organizations that must meet accessibility and bilingualism standards. It attempts to integrate with the design patterns found in the WET-BOEW and design system, including the mandatory Content and Information Architecture (C&IA) Specification for the Government of Canada.

To make working with Drupal WxT easier, there are potentially three ways you can approach it.


The Drupal WxT distribution method stands out as a preferred choice for web developers and organizations seeking a robust web development solution.

Unlike a standalone installation, the distribution provides a comprehensive package of features and workflows that have been vetted and tested by the Drupal WxT community based on real world use cases.

This means users can leverage a well-established framework with proven capabilities, saving time and effort in development while ensuring stability and reliability.

By opting for the distribution method, teams gain access to shared resources, ongoing support, and a community-driven ecosystem, hopefully helping to build accessible, and bilingual web experiences with confidence.


  • Many canadian departments and organizations have contributed features and improvements
  • Has received several security and accessibility audits to the codebase and markup
  • Will stay on top of security releases within a maximum of 72 hours of posting
  • Creation of many plugins in order to more fully integrate with the WET-BOEW and design system
  • Best effort open source support from a community of developers
  • Provides upgrade paths for all supported components
  • Additional functionality is provided by WxT Extend modules which target a specific feature
  • Stays on top of performance related issues taking into account both MySQL and PostgreSQL


ComponentFeaturesMachine NameType
WxT (Installation Profile)
  • Provides a custom installation profile
WxT Bootstrap (Theme)
  • Provides Templates to adhere to the WET-BOEW and Design System and C&IA Specification
WxT Library (Module)
  • Integrates Drupal with WET-BOEW Framework Assets (CSS/JS)
WxT Admin (Module)
  • Provides the default configuration and various helper methods for administrative tasks
WxT Core (Module)
  • Provides the core configuration and all update related hooks for WxT as a whole
WxT Extend (Module)
  • Provides 40+ modules where many target a specific feature within the WET-BOEW and design system:
    • Archived (#3097228): Creates an archived alert block triggered by a checkbox field on a entity
    • Blocks: Creates custom blocks of type Basic, Search, and Spotlight
    • Blog (#3306505): Creates a default Blog listing layout page
    • Book (#3219195): Configures book module to support GC Subway functionality
    • Breadcrumb (#3203791): Configures breadcrumb and related functionality
    • Carousel (#3313685): Creates custom block of type Carousel
    • Comment: Creates comment functionality for entities
    • Editor (#3255971): Provides CKEditor 4/5 integration along with several plugins (WET Alert, Panels)
    • Font Awesome: Adds Font Awesome support
    • Group: Provides Group functionality and mappings to all departments through Migrate
    • Landing Page: Provides Landing Page related functionality
    • Layout: Provides Layout related functionality and enhancements
    • Media: Provides Media related functionality and enhancements
    • Media Audio: Provides an Audio entity type for Media
    • Media Bulk Upload: Provides improvements to Bulk Upload for Media
    • Media Document: Provides a Document entity type for Media
    • Media Image: Provides an Image entity type for Media
    • Media Image Responsive: Provides responsive image support for Media
    • Media Instagram: Provides an Instagram entity type for Media
    • Media Slideshow: Provides a Slideshow entity type for Media
    • Media Twitter: Provides a Twitter entity type for Media
    • Media Video: Provides a Video entity type for Media
    • Metatag: Configures Metatag and related functionality
    • Migration: Provides Migration related functionality along with a plethora of plugins and default content
    • Page: Provides customizations and defaults for the Page content type
    • Paragraph: Provides Paragraph and related functionality
    • Password Policy: Provides a strong ISM password policy
    • Queue: Provides Queueing and related functionality
    • Search: Provides a default setup for Search API
    • Search DB: Provides a default setup for Search w/Database Backend
    • Sitemap: Provides a default sitemap
    • Taxonomy: Provides taxonomy vocabularies used for categorizing content
    • Theme: Provides theming and related functionality
    • User: Provides User and related enhancements
    • Webform: Provides enhanced functionality and custom plugins (Report a Problem, Did you Find)
    • Workflow: Provides enhanced functionality to improve your content workflow
WxT Translation (Module)
  • Ensures that both of the official languages for Canada are setup correctly
  • Provides additional functionality for interacting with Drupal Core’s language subsystem:
    • Translation helper class for importing translations for a given module
    • Various other helper methods for enabling, importing and updating translations

    Standalone Installation

    A standalone installation allows you to install and configure the standalone components type discussed in the previous section separately without relying on a pre-packaged distribution (composer project).

    A composer project will often include multiple modules whether both custom and contributed along with the various configuration and dependencies they will rely on.

    Drupal WxT offers a standalone installation as an alternative for those users who don’t want the full weight of a distribution and prefer more control over their setup while still conforming to the Government of Canada C&IA Specification.

    Instead users can opt to create their own distribution (composer project) and install only the specific modules and themes required for their needs.

    At a minimum and to comply with the WET-BOEW and design system you only need use 2 components.



    ComponentFeaturesMachine NameType
    WxT Bootstrap (Theme)
    • Provides Templates to adhere to the C&IA Specification
    WxT Library (Module)
    • Integrates Drupal with WET-BOEW Framework Assets (CSS/JS)

    For the WET-BOEW Framework Assets it is mandatory that you follow the expected naming convention and that these files be placed within the /libraries folder.

    For you convenience all of these components are already part of a composer repository that can be added very easily to your new or existing composer project.

        "require": {
            "drupal/wxt_bootstrap": "7.1",
            "drupal/wxt_library": "7.1",
        "repositories": [
                "type": "composer",
                "url": ""

    Note: It is still recommended to use the distribution method, as the standalone option receives limited support and you will lose out on some of the functionality / plugins that help to more fully integrate with the WET-BOEW and design system.

    Leverage as a Reference Implementation

    If you prefer full control over your codebase and want to reduce external dependencies, you can use Drupal WxT as a reference implementation.

    This means that, as long as you provide proper attribution, you have the freedom to copy or fork any part of the codebase and incorporate it into your own project.

    The main drawback of this approach is that you won’t receive community support and also won’t have the same tight integration of features with the WET-BOEW and design system.

    However you can selectively choose exactly what you need for your project, potentially saving some time and reducing additional external dependencies.

    Our advice at the end of the day is you must consider what is best for your department or organization in the long term.

    1.2 - Installation

    We highly recommend using our Composer Project Template to build and maintain your WxT derived project’s codebase.

    Server Requirements

    As Drupal WxT is a Drupal distribution, the official guide for Drupal system requirements will apply.


    • Composer Download
    • Tarball Download
    • Site Installation
    • Standalone Installation
    • Default Content via Migrate

    Composer Download

    Run this command and replace DIRECTORY with the directory of your choice this is where WxT will be installed.

    composer self-update
    composer create-project drupalwxt/site-wxt:9.5.x-dev <site-name> --no-interaction

    Note: Normally you would pass a stable tag to the above command rather then just pulling from the development branch.

    Tarball Download

    If you don’t want to use Composer, you can install WxT the traditional way by downloading a tarball from WxT’s GitHub releases page.

    Note: That the tarball generated by the packager does not include the required Composer dependencies and should not be used without following the specialized instructions.


    For the (optional) container based local development workflow please consult our documentation site:

    Site Installation

    a) The Drupal Root is in <site-name>/html

    b) You can install Drupal WxT through the browser as any other drupal installation or use drush site-install to install the WxT installation profile:

    drush si wxt \
      --sites-subdir=default \
      --db-url=mysql://root:root@db:3306/wxt \
      --account-name=admin \
      --account-pass=Drupal@2023 \ \
      --site-name="Drupal Install Profile (WxT)" \
      wxt_extension_configure_form.select_all='TRUE' \
      install_configure_form.update_status_module='array(FALSE,FALSE)' \

    Note: If you wish to only install the minimum set of dependencies please remove the wxt_extension_configure_form.select_all='TRUE' flag in its entirety.

    c) You can download up-to-date translations using:

    drush locale-check
    drush locale-update

    d) If you work for the Government of Canada you will want to enable the theme:

    drush config-set wxt_library.settings wxt.theme theme-gcweb -y

    Note: You can navigate to the admin/config/wxt/wxt_library settings page.

    e) The Drupal WxT site should now be sucessfully installed and you can loging via the /user page.

    Note: Please always go to the admin/report/status page and confirm there are no warnings and / or errors.

    Standalone Installation

    The standalone install is provided as an additional method for those who do not wish to have the full weight of a distribution and its required dependencies. You will need to add at the minimum the below listed modules and themes (including Bootstrap base theme) as well as the WxT jQuery Framework assets installed into the /libraries folder with the proper naming scheme.

    Note: We highly recommend that you use the distribution method as limited support is provided for the standalone method.

    Default Content via Migrate

    The following is an example of how to use the Migrate API module to import common design patterns for aligning to the C&IA specifications:

    # Set the WxT theme to GCWeb
    drush config-set wxt_library.settings wxt.theme theme-gcweb -y
    # Import design patterns for
    drush migrate:import --group wxt --tag 'Core'
    drush migrate:import --group gcweb --tag 'Core'
    drush migrate:import --group gcweb --tag 'Menu'
    drush cr

    Note: There is a corresponding group wxt_translation and gcweb_translation for importing the corresponding french content.

    1.3 - Update Process

    Drupal WxT relies on Drupal’s configuration system for configuring default features and functionality. A consequence of this is, once you have installed Drupal WxT, that we cannot modify the sites configuration without having an impact on your site. Drupal WxT will, however, offer to make changes to your configuration as part of the update process.

    If you’ve installed WxT using our Composer-based project template, all you need to do is following the given steps below.

    Update Process

    These are the typical steps you should following when updating Drupal WxT:

    a) Read the release notes for the release to which you are updating along with any releases in between.

    b) To update your WxT codebase you would replace [VERSION] with the release version you wish to use.

    composer self update
    composer require drupalwxt/wxt:[VERSION]
    composer update

    Note: We highly recommend that you are using the v2.x.x line of Composer.

    c) Run any database updates:

    drush cache:rebuild
    drush updatedb

    Note: You may instead go to /admin/config/development/performance to clear caches and /update.php to run database updates.

    d) Run any WxT configuration updates:

    drush cache:rebuild
    drush update:wxt

    Note: You may instead go to /admin/config/development/performance to clear caches and /update.php to run WxT updates.

    Configuration Management

    If you are using configuration management to move your configuration between development, staging, and production environments, you should follow the standard Drupal process.

    a) Export the new configuration:

    drush cache:rebuild
    drush config:export

    b) Commit the code and configuration changes to your source code repository and push them to your environment.

    c) Import any configuration changes:

    drush cache:rebuild
    drush config:import

    1.4 - Releases

    Releases of Drupal WxT

    The following table is a list of all the releases that are housed under the Drupal WxT organization on GitHub:

    ReleaseCreated DateDescription

    Features / Updates:

    • Build Infrastructure
      • Add DB_VERSION variable to .env
    • Security Updates for Drupal Core
    • Updates for Drupal Core
      • N/A
    • Updates for Drupal Contrib
      • Build update for wxt, upgrade ckeditor4_codemirror 3382999
    • Updates for WxT
      • Minor naming adjustments and proper location of config objects
      • Call to deprecated function file_create_url() 3387600
    • Updated for WxT Bootstrap
      • Support for composer/installers 2.x 3382948
    • Updates for WxT Library
      • Support for composer/installers 2.x 3382948

    Upgrade path:

    Important: Please backup your database before running the upgrade process for this release.

    • Update your codebase:

      • composer update
    • Run database updates:

      • drush cache:rebuild
      • drush updatedb
    • Run WxT configuration updates:

      • drush cache:rebuild
      • drush update:wxt


    This is the first stable release of v5.0.0 please ensure you have read the release notes from the previous release candidates.


    Features / Updates:

    • Updates for Drupal Contrib
      • core_context to 1.1
    • Updates for WxT
      • Remove duplicate editor/filter config 3381990
      • CKEditor JS error with JS aggregation enabled 3381980
      • CKEditor5 and CKEditor compatibility support 3382168
    • Updated for WxT Bootstrap
    • Updates for WxT Library
      • Correct logic for Search block visibility reliance on core search

    Upgrade path:

    Important: Please backup your database before running the upgrade process for this release.

    • Update your codebase:

      • composer update
    • Run database updates:

      • drush cache:rebuild
      • drush updatedb
    • Run WxT configuration updates:

      • drush cache:rebuild
      • drush update:wxt


    There were some issues in 5.0.0-rc1 related to the text formats and filters logic.

    The rich_text format now functions as before using CKEditor4.

    There is a new rich_text_ckeditor5 format which uses the newer CKEditor5.


    Features / Updates:

    • Build Infrastructure
      • [CI] Point build system to 10.0.x docker-scaffold
      • [PHP] Build properly on php 8.1+
      • Remove drupal-console-extend-plugin
    • Security Updates for Drupal Core
    • Updates for Drupal Core Patch (bugfix) release of Drupal Core to v10.0.10
    • Updates for Drupal Contrib
      • [Composer] Update all contrib to Drupal 10 versions
      • Support for CKEditor 5 3255971
      • Add codemirror back to CKEditor5 3361536
    • Updates for WxT
      • Check $profile is not null condition
      • Remove non-existant permissions from wxt_ext_user
      • Give users ability to edit existing alerts and panels in CKEditor 5 3361560
      • Remove And/Or plugin from wxt_ext_editor 3361566
      • Add gcweb styles to CKEditor5 3362435
      • Add selection handle to allow moving alert and panel widgets 3362705
      • Default well panels being converted to default panels 3362702
      • Add ability to set permissions for wxt_ext_breadcrumbs 3366800
      • Vanilla rich text ckeditor4 notice when editing existing french content 3362793
      • Keep drupal/groups disabled by default 3357710
      • The drush si then drush sql-drop then drush si again results in file exists 3374003
      • Using non-existent parameter “config.export.commands” 3377173
      • Enable linkit in rich text editor 3377252
      • Issue with password_policy and PostgreSQL 3377970
      • Panels Restore Style Settings and classes 3377979
      • Improve placement of bootstrap ckeditor library 3376951
      • The ckeditor5 div class attribute is removed/deleted 3362788
      • password policy is preventing hooks from firing 3313274
      • Add SVG icons to alert/panel widgets in CKE5 3380029
      • ckeditor 5 footnotes related 3377942
      • Enable Table of Contents filter 3380730
      • codemirror support for both ckeditor4 and ckeditor5 3362801
    • Updated for WxT Bootstrap
      • Update *.info.yml + composer.json to allow install on D10
      • Update Bootstrap to v3.27
      • Fix reference to deprecated node_type plugin in optional config
      • Fix twig errors with input template and it’s extensions
      • Replace ckeditor-stylesheets with ckeditor5 version
      • Twig deprecation fix for wxt_bootstrap spaceless 3362712
      • Bootstrap requires underscore.js but it was removed from D10 core 3362764
      • wxt_ext_blog - Firstname Lastname - Date 3367309
      • Drupal 10.1.1 requires bootstrap 3.29 , 3.29 also compatible with D10.0.10 and D9.5.10 3374741
      • Typo in template files: “clas” 3356383
      • Empty label can lead to empty ‘h3’, invalid HTML 3356385
    • Updates for WxT Library
      • Update *.info.yml + composer.json to allow install on D10
      • Drupal 10 comptaibility updates 3346270
      • language switcher fix related to Core Security update 3349214
      • Issue with wxt_library.module and php 8.1 3368356
      • Remove IE8 from the wxt build, IE8 cleanup 3374233

    Upgrade path:

    Important: Please backup your database before running the upgrade process for this release.

    • Update your codebase:

      • composer update
    • Run database updates:

      • drush cache:rebuild
      • drush updatedb
    • Run WxT configuration updates:

      • drush cache:rebuild
      • drush update:wxt


    This is an upgrade from 9.5.x to 10.0.x however changes are minimal and is expected upgrades will be fairly smooth.


    Features / Updates:

    • Updates for Drupal Core
      • Patch (bugfix) release of Drupal Core to v9.5.10
    • Updates for Drupal Contrib
      • Incompatible version for ckeditor/fakeobjects #3363952
      • Update migrate_plus to ^6.0 #3372334
    • Updates for WxT
      • Check $profile is not null condition.
      • Add ability to set permissions for wxt_ext_breadcrumbs #3366800
      • Keep drupal/groups disabled by default #3357710
      • Undefined array key ’editor’ in wxt_ext_editor_editor_js_settings_alter #3373991
    • Updates for WxT Bootstrap
      • Issue #3356383 by Liam Morland: Typo in template files: “clas” #3373991
      • Issue #3356385 by Liam Morland: Empty label can lead to empty ‘h3’, invalid HTML #3373991
    • Updates for WxT Library
      • Issue with wxt_library.module and php 8.1 #3368356
      • Remove IE8 from the wxt build, IE8 cleanup #3374233

    Upgrade path:

    Important: Please backup your database before running the upgrade process for this release.

    • Update your codebase:

      • composer update
    • Run database updates:

      • drush cache:rebuild
      • drush updatedb
    • Run WxT configuration updates:

      • drush cache:rebuild
      • drush update:wxt




    Features / Updates:

    • Remove accidentally committed composer.lock file

    Upgrade path:

    Important: Please backup your database before running the upgrade process for this release.

    • Update your codebase:

      • composer update
    • Run database updates:

      • drush cache:rebuild
      • drush updatedb
    • Run WxT configuration updates:

      • drush cache:rebuild
      • drush update:wxt


    There is a core regression of the language switcher block which throws exception when no route is matched.

    WxT Library is patched so it will not have this problem.

    Repositories for Drupal WxT

    The following table is a list of all the repositories that are housed under the Drupal WxT organization on GitHub:

    composer-extdepsdrupalwxt/composer-extdepsComposer repository for external dependencies on Drupal WxTSize: 56 Bytes
    docker-scaffolddrupalwxt/docker-scaffoldDocker Scaffold for Drupal WxTSize: 181 Bytes
    drupalwxt.github.iodrupalwxt/drupalwxt.github.ioGitHub Pages for Drupal WxT.Size: 12026 Bytes
    helm-drupaldrupalwxt/helm-drupalHelm chart for running Drupal on KubernetesSize: 67026 Bytes
    site-wxtdrupalwxt/site-wxtAn example composer project for the Drupal WxT distribution used for integration testing.Size: 3733 Bytes
    terraform-kubernetes-drupalwxtdrupalwxt/terraform-kubernetes-drupalwxtTerraform module for Drupal WxTSize: 68 Bytes
    themes-cdndrupalwxt/themes-cdnContent Delivery Network (CDN) files for the theme repositories of the Web Experience Toolkit (WET)Size: 12445 Bytes
    wxtdrupalwxt/wxtDrupal 9 / 10 variant of the Web Experience Toolkit (WxT).Size: 2802 Bytes
    wxt-projectdrupalwxt/wxt-projectComposer project template for Drupal 9 sites built with the WxT distribution.Size: 88 Bytes
    wxt_bootstrapdrupalwxt/wxt_bootstrapBootstrap derived sub-theme aligned for use with the Web Experience Toolkit jQuery Framework.Size: 1202 Bytes
    wxt_librarydrupalwxt/wxt_libraryWeb Experience Toolkit Framework integration for Drupal.Size: 134 Bytes

    1.6 - Roadmap

    The core distribution will always strive to be:

    • As minimal as possible on top of Drupal Core providing performance, scalability, and security features on top of it
    • Provide best practices for users to follow which includes our Composer workflow, CI / CD methodologies, and deployment strategies
    • Provide a place for all Government Departments to inherit the base requirements such as Language Handling, GC Approved Themes, and other functionalities such as Date Format, Metadata Output, and Accessibility improvements

    Beyond the above the distribution will provide extensible features that can be opted into through the wxt_ext suite of modules:

    • Each of these modules must explicitly state all of there contributed dependencies
    • Governance around these “extension” modules can be a bit looser
    • These modules should be clear in focus and not try to do to much other then an immediate task at hand
    • These modules should have an modulename.wxt_extension.yml file so can be enabled as optional extension during profile installation

    In addition, Drupal WxT will offer out of tree (external) modules that implement specific features:

    • These features are not included by the core platform because they are only used by a subset of users
    • These modules may be subject to change though update hooks will always be provided
    • Community supported modules will also be listed in our README of additional modules but will not be supported by the Drupal WxT team

    Note: The governance around the core distribution will always be much stricter then the governance around adding a wxt_ext or an out of tree module.

    2 - Development

    This section provides information for developers who wish to help collaborate and improve Drupal WxT.

    2.1 - Architecture

    The goal of Drupal WxT since the 4.1.x line is to make the installation profile very minimal by default but providing additional extensions that can be enabled as desired.

    What WxT offers is some light enhancements to Drupal Core, mainly around security and performance, and integration with the Web Experience Toolkit. By default, the distribution offers minimal functionality to allow full customizations by users. However a great deal of optional extensions are available that can provide additional functionality generally beneficial to Government departments.

    Note: In the future we are looking into providing a list of community modules that are build to work with the distribution but are “out of tree”.

    All of the optional modules are located in the wxt_ext folder named after WxT Extend and can be enabled during the initial site installation by passing the following flag via the drush cli:


    Note: If you wish to only install the minimum set of dependencies please remove the wxt_extension_configure_form.select_all='TRUE' flag in its entirety.

    In order to provide a list of the optional enabled extensions during the installation that can be checked, all that any module has to do is provide a modulename.wxt_extension.yml file in their root and they will be picked as installable during the profile install and also respond to the additional drush flag discussed above.

    For more information on some of the history leading to this design:

    2.2 - Composer

    We highly recommend using our Composer Project Template to build and maintain your WxT derived project’s codebase.

    Getting Started

    The following command is all you need to get started:

    composer create-project drupalwxt/wxt-project:4.3.4 <site-name>

    Note: For development you may also specify a branch using drupalwxt/wxt-project:4.3.x-dev.

    You can see a working example of a fully generated Composer Project Template over at:

    Where the following is the command that was used for the initial generation:

    composer create-project drupalwxt/wxt-project:4.3.4 site-wxt

    Note: Remember to keep the composer.json and composer.lock files that exist above docroot in source control as they are controlling your dependencies.


    List of common commands are as follows:

    Installing a contrib project (latest version)composer require drupal/PROJECT
    Installing a contrib project (specific version)composer require drupal/PROJECT:1.0.0-beta5
    Updating all projects including Drupal Corecomposer update
    Updating a single contrib projectcomposer update drupal/PROJECT_NAME
    Updating Drupal Corecomposer update drupal/core

    Note: Composer is a dependency manager and helps us keep track of what code and at what version our application relies on so that it always get installed the right way on every copy of that application.

    Specifying a version

    A specific version can be specified from the cli:

    composer require drupal/<modulename>:<version>

    However please note if you specify a branch, such as 1.x you must add -dev to the end of the version:

    composer require drupal/token:1.x-dev

    Source Control

    Taking a look at the .gitignore file, you will discover that certain directories, including all those directories containing contributed projects, are excluded from source control which is by design.

    Note: Unlike Drush in a Composer derived project you should never commit your install dependencies to source control.

    Composer will create composer.lock file, which is a list of dependencies that were installed, and in which versions.

    Note: In general you should always commit your composer.lock file to source control so that others via a quick composer install can have everything installed along with the correct versions specified in the composer.lock file.

    How to update Drupal Core?

    Please don’t add drupal/core to your project’s composer.json since WxT manages Drupal Core for you along with the series of patches on top of it.

    WxT’s minor versions will always correspond to Drupal Core’s. For example, drupalwxt/wxt:~5.0.x will require Drupal Core 10.0.x and drupalwxt/wxt:~4.5.x required Drupal Core 9.5.x.

    When you need to update Drupal Core as an example from 9.5.x to 10.0.x, all you would do is change your requirement for drupalwxt/wxt in your composer.json file:

    composer require --no-update drupalwxt/wxt:~5.0.0
    composer update

    Note: This assumes you have already backed up your database prior to attembting a major version upgrade.

    Compatibility table

    drupalwxt/wxt versionDrupal Core versionDrush version

    2.3 - Configuration Management

    Drupal WxT thanks to the work done by the Acquia Team is able to use advanced configuration management strategies.

    At the moment this remains an opt-in process and you will have to add the following modules to your composer.json before you add the code snippet below to your settings.php file.

    Once enabled all default configuration will be stored in /sites/default/files/config/default/ and then depending on your environment additionally configuration splits can be leveraged depending on your SDLC.

     * Configuration Split for Configuration Management
     * WxT is following the best practices given by Acquia for configuration
     * management. The "default" configuration directory should be shared between
     * all multi-sites, and each multisite will override this selectively using
     * configuration splits.
     * To disable this functionality simply set the following parameters:
     * $wxt_override_config_dirs = FALSE;
     * $settings['config_sync_directory'] = $dir . "/config/$site_dir";
     * See
     * for more information.
    use Drupal\wxt\Robo\Common\EnvironmentDetector;
    if (!isset($wxt_override_config_dirs)) {
      $wxt_override_config_dirs = TRUE;
    if ($wxt_override_config_dirs) {
      $config_directories['sync'] = $repo_root . "/var/www/html/sites/default/files/config/default";
      $settings['config_sync_directory'] = $repo_root . "/var/www/html/sites/default/files/config/default";
    $split_filename_prefix = 'config_split.config_split';
    if (isset($config_directories['sync'])) {
      $split_filepath_prefix = $config_directories['sync'] . '/' . $split_filename_prefix;
    else {
      $split_filepath_prefix = $settings['config_sync_directory'] . '/' . $split_filename_prefix;
     * Set environment splits.
    $split_envs = [
    foreach ($split_envs as $split_env) {
      $config["$split_filename_prefix.$split_env"]['status'] = FALSE;
    if (!isset($split)) {
      $split = 'none';
      if (EnvironmentDetector::isLocalEnv()) {
        $split = 'local';
      if (EnvironmentDetector::isCiEnv()) {
        $split = 'ci';
      if (EnvironmentDetector::isDevEnv()) {
        $split = 'dev';
      elseif (EnvironmentDetector::isTestEnv()) {
        $split = 'test';
      elseif (EnvironmentDetector::isQaEnv()) {
        $split = 'qa';
      elseif (EnvironmentDetector::isProdEnv()) {
        $split = 'prod';
    if ($split != 'none') {
      $config["$split_filename_prefix.$split"]['status'] = TRUE;
     * Set multisite split.
    // $config["$split_filename_prefix.SITENAME"]['status'] = TRUE;

    2.4 - Performance

    Below are some recommended settings that improve the performance of Drupal WxT sites.

    2.4.1 - PostgreSQL

    To properly configure PostgreSQL with Drupal you should ensure the following configuration is used.

    Note: Some customizations might be necessary depending on your individual requirements.

      listenAddresses: "'*'"
      maxConnections: "200"
      sharedBuffers: 512MB
      workMem: 2048MB
      effectiveCacheSize: 512MB
      effectiveIoConcurrency: "100"
      maintenanceWorkMem: 32MB
      minWalSize: 512MB
      maxWalSize: 512MB
      walBuffers: 8048kB
      byteaOutput: "'escape'"
      hugePages: "off"
      walLevel: "replica"
      maxWalSenders: "0"
      synchronousCommit: "on"
      walKeepSegments: "130"
      checkpointTimeout: "'15 min'"
      checkpointCompletionTarget: "0.9"
      walCompression: "on"
      walWriterDelay: 200ms
      walWriterFlushAfter: 1MB
      bgwriterDelay: 200ms
      bgwriterLruMaxpages: "100"
      bgwriterLruMultiplier: "2.0"
      bgwriterFlushAfter: "0"
      maxWorkerProcesses: "8"
      maxParallelWorkersPerGather: "4"
      maxParallelWorkers: "4"

    Note: The above is written in yaml syntax which will work for both Docker Compose and Kubernetes Helm Charts. For the postgresql.conf file itself without using these tools simply find the _ counterpart.

    Queries leveraging ILIKE

    There is a known PostgreSQL performance issue that exists in Drupal and is related to leveraging queries with ILIKE.

    This issue is particularly noticeable in relation to the path_alias table.

    There are patches being worked on to handle this in Drupal core but a very quick fix can be implemented leveraging pg_trgm.

    There is a great blog article listed below which goes over this issue in more detail.

    The instructions are a bit outdated so the updated syntax to enter in psql is given below:

    CREATE INDEX path_alias__alias_trgm_gist_idx ON path_alias USING gist (alias gist_trgm_ops);
    CREATE INDEX path_alias__path_trgm_gist_idx ON path_alias USING gist (path gist_trgm_ops);
    ANALYZE path_alias;

    2.4.2 - Redis

    To properly configure Redis with Drupal you should ensure the following configuration is added to your settings.php file.

    Note: Some customizations might be necessary depending on your individual requirements.

    if (extension_loaded('redis')) {
      // Set Redis as the default backend for any cache bin not otherwise specified.
      $settings['cache']['default'] = 'cache.backend.redis';
      $settings['redis.connection']['interface'] = 'PhpRedis';
      $settings['redis.connection']['scheme'] = 'http';
      $settings['redis.connection']['host'] = 'localhost';
      $settings['redis.connection']['port'] = '6379';
      $settings['redis.connection']['password'] = getenv('REDIS_PASSWORD') ?: '';
      $settings['redis.connection']['persistent'] = FALSE;
      // Allow the services to work before the Redis module itself is enabled.
      $settings['container_yamls'][] = 'modules/contrib/redis/';
      $settings['container_yamls'][] = 'modules/contrib/redis/';
      // Manually add the classloader path, this is required for the container cache bin definition below
      // and allows to use it without the redis module being enabled.
      $class_loader->addPsr4('Drupal\\redis\\', 'modules/contrib/redis/src');
      $settings['bootstrap_container_definition'] = [
        'parameters' => [],
        'services' => [
          'redis.factory' => [
            'class' => 'Drupal\redis\ClientFactory',
          'cache.backend.redis' => [
            'class' => 'Drupal\redis\Cache\CacheBackendFactory',
            'arguments' => ['@redis.factory', '@cache_tags_provider.container', '@serialization.phpserialize'],
          'cache.container' => [
            'class' => '\Drupal\redis\Cache\PhpRedis',
            'factory' => ['@cache.backend.redis', 'get'],
            'arguments' => ['container'],
          'cache_tags_provider.container' => [
            'class' => 'Drupal\redis\Cache\RedisCacheTagsChecksum',
            'arguments' => ['@redis.factory'],
          'serialization.phpserialize' => [
            'class' => 'Drupal\Component\Serialization\PhpSerialize',
      /** Optional prefix for cache entries */
      $settings['cache_prefix'] = 'drupal_';
      // Always set the fast backend for bootstrap, discover and config, otherwise
      // this gets lost when redis is enabled.
      $settings['cache']['bins']['bootstrap'] = 'cache.backend.chainedfast';
      $settings['cache']['bins']['discovery'] = 'cache.backend.chainedfast';
      $settings['cache']['bins']['config'] = 'cache.backend.chainedfast';
      // Use for all bins otherwise specified.
      $settings['cache']['default'] = 'cache.backend.redis';
      // Use for all queues unless otherwise specified for a specific queue.
      $settings['queue_default'] = 'queue.redis';
      // Or if you want to use reliable queue implementation.
      // $settings['queue_default'] = 'queue.redis_reliable';
      // Use this to only use Redis for a specific queue.
      // $settings['queue_service_aggregator_feeds'] = 'queue.redis';
      // Use this to use reliable queue implementation.
      // $settings['queue_service_aggregator_feeds'] = 'queue.redis_reliable';

    2.4.3 - Varnish

    To properly configure Varnish with Drupal you should ensure the following configuration is your default.vcl file.

    Note: Some customizations might be necessary depending on your individual requirements.

    vcl 4.0;
    import std;
    import directors;
    backend nginx {
      .host = "hostname-nginx";
      .host_header = "hostname-nginx";
      .port = "80";
    sub vcl_init {
      new backends = directors.round_robin();
    sub vcl_recv {
      set req.http.X-Forwarded-Host = req.http.Host;
      if (!req.http.X-Forwarded-Proto) {
        set req.http.X-Forwarded-Proto = "http";
      # Answer healthcheck
      if (req.url == "/_healthcheck" || req.url == "/healthcheck.txt") {
        return (synth(700, "HEALTHCHECK"));
      set req.backend_hint = backends.backend();
      # Answer healthcheck
      if (req.url == "/_healthcheck" || req.url == "/healthcheck.txt") {
        return (synth(700, "HEALTHCHECK"));
      set req.backend_hint = backends.backend();
      # Always cache certain file types
      # Remove cookies that Drupal doesn't care about
      if (req.url ~ "(?i)\.(asc|dat|tgz|png|gif|jpeg|jpg|ico|swf|css|js)(\?.*)?$") {
        unset req.http.Cookie;
      } else if (req.http.Cookie) {
        set req.http.Cookie = ";" + req.http.Cookie;
        set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
        set req.http.Cookie = regsuball(req.http.Cookie, ";(SESS[a-z0-9]+|SSESS[a-z0-9]+|NO_CACHE)=", "; \1=");
        set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
        set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
        if (req.http.Cookie == "") {
            unset req.http.Cookie;
        } else {
            return (pass);
      # If POST, PUT or DELETE, then don't cache
      if (req.method == "POST" || req.method == "PUT" || req.method == "DELETE") {
        return (pass);
      # Happens before we check if we have this in cache already.
      # Typically you clean up the request here, removing cookies you don't need,
      # rewriting the request, etc.
      return (hash);
      #return (pass);
    sub vcl_backend_fetch {
      # NEW
      set bereq.http.Host = "hostname-nginx";
      # Don't add to X-Forwarded-For
      set bereq.http.X-Forwarded-For = regsub(bereq.http.X-Forwarded-For, "(, )?127\.0\.0\.1$", "");
    sub vcl_backend_response {
      if (beresp.http.Location) {
        set beresp.http.Location = regsub(
          bereq.http.X-Forwarded-Proto + "://" + bereq.http.X-Forwarded-Host + "/"
      # Only cache select response codes
      if (beresp.status == 200 || beresp.status == 203 || beresp.status == 204 || beresp.status == 206 || beresp.status == 300 || beresp.status == 301 || beresp.status == 404 || beresp.status == 405 || beresp.status == 410 || beresp.status == 414 || beresp.status == 501) {
        # Cache for 5 minutes
        set beresp.ttl = 5m;
        set beresp.grace = 12h;
        set beresp.keep = 24h;
      } else {
        set beresp.ttl = 0s;
    sub vcl_deliver {
      # Remove identifying information
      unset resp.http.Server;
      unset resp.http.X-Powered-By;
      unset resp.http.X-Varnish;
      unset resp.http.Via;
      # Comment these for easier Drupal cache tag debugging in development.
      unset resp.http.Cache-Tags;
      unset resp.http.X-Drupal-Cache-Contexts;
      # Add Content-Security-Policy
      # set resp.http.Content-Security-Policy = "default-src 'self' * *; style-src 'self' 'unsafe-inline' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *  * blob:; connect-src 'self' * * * *; img-src 'self' * * * * data:; font-src 'self' *";
      # Add CORS Headers
      # if (req.http.Origin ~ "(?i)\.example\.ca$") {
      #   if (req.url ~ "\.(ttd|woff|woff2)(\?.*)?$") {
      #     set resp.http.Access-Control-Allow-Origin = "*";
      #     set resp.http.Access-Control-Allow-Methods = "GET";
      #   }
      # }
      # Add X-Frame-Options
      if (req.url ~ "^/livechat" || req.url ~ "^/(en/|fr/)?entity-browser/") {
        set resp.http.X-Frame-Options = "SAMEORIGIN";
      } else {
        set resp.http.X-Frame-Options = "DENY";
      set resp.http.X-Content-Type-Options = "nosniff";
      set resp.http.X-XSS-Protection = "1; mode=block";
      # Happens when we have all the pieces we need, and are about to send the
      # response to the client.
      # You can do accounting or modifying the final object here.
      if (obj.hits > 0) {
        set resp.http.X-Cache = "HIT";
      } else {
        set resp.http.X-Cache = "MISS";
      # Handle errors
      if ( (resp.status >= 500 && resp.status <= 599)
        || resp.status == 400
        || resp.status == 401
        || resp.status == 403
        || resp.status == 404) {
        return (synth(resp.status));
    sub vcl_synth {
      # Remove identifying information
      unset resp.http.Server;
      unset resp.http.X-Powered-By;
      unset resp.http.X-Varnish;
      unset resp.http.Via;
      # Add Content-Security-Policy
      # set resp.http.Content-Security-Policy = "default-src 'self' *; style-src 'self' 'unsafe-inline' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' * * blob:; connect-src 'self' * * * *; img-src 'self' * data:;";
      # set resp.http.X-Content-Type-Options = "nosniff";
      # set resp.http.X-Frame-Options = "DENY";
      # set resp.http.X-XSS-Protection = "1; mode=block";
      # if (resp.status >= 500 && resp.status <= 599) {
      #   set resp.http.Content-Type = "text/html; charset=utf-8";
      #   synthetic(std.fileread("/data/configuration/varnish/errors/503.html"));
      #   return (deliver);
      # } elseif (resp.status == 400) { # 400 - Bad Request
      #   set resp.http.Content-Type = "text/html; charset=utf-8";
      #   synthetic(std.fileread("/data/configuration/varnish/errors/400.html"));
      #   return (deliver);
      # } elseif (resp.status == 401) { # 401 - Unauthorized
      #   set resp.http.Content-Type = "text/html; charset=utf-8";
      #   synthetic(std.fileread("/data/configuration/varnish/errors/401.html"));
      #   return (deliver);
      # } elseif (resp.status == 403) { # 403 - Forbidden
      #   set resp.http.Content-Type = "text/html; charset=utf-8";
      #   synthetic(std.fileread("/data/configuration/varnish/errors/403.html"));
      #   return (deliver);
      # } elseif (resp.status == 404) { # 404 - Not Found
      #   set resp.http.Content-Type = "text/html; charset=utf-8";
      #   synthetic(std.fileread("/data/configuration/varnish/errors/404.html"));
      #   return (deliver);
      # } else
      if (resp.status == 700) { # Respond to healthcheck
        set resp.status = 200;
        set resp.http.Content-Type = "text/plain";
        synthetic ( {"OK"} );
        return (deliver);
    # sub vcl_backend_error {
    #   set beresp.http.Content-Type = "text/html; charset=utf-8";
    #   synthetic(std.fileread("/data/configuration/varnish/errors/503.html"));
    #   return (deliver);
    # }

    2.5 - Release Process

    Select a version number

    WxT releases are numbered using a form of semantic versioning. More information can be found in our Versioning page.


    In general, when preparing a release: increment the FEATURE when Drupal Core has a major release (ie. 9.5.x to 10.0.x) otherwise simply increment the SPRINT number.

    Create an issue on

    Create an issue in the Drupal WxT project on GitHub for release tracking, title it Release x.x.x (where x.x.x is the incremented version number).

    This issue should contain the following checklist as well as any other related steps or information regarding preparing the release.

    See the [full release documentation]( for more detail.
    - [ ] All related projects (wxt_library and wxt_bootstrap) tagged and released on and
    - [ ] Version number selected
    - [ ] updated
    - [ ] composer.json updated
    - [ ] Run for hook_updates and wxt contrib
    - [ ] CI build passes
    - [ ] Releases tagged and pushed to and
    - [ ] WxT released on (
    - [ ] Add changelog information to published tag once CI is done

    Update changelog

    Ensure the changelog contains an entry for the release and is updated as issues and changes are resolved (in the next steps or when committing code / changes).

    Review dependent wxt modules

    1. Review contrib modules in composer.json (or in a site install; extend->update) and update as necessary.
    2. If necessary, tag wxt_library and update wxt’s composer.json file
    3. If necessary, tag wxt_bootstrap and update wxt’s composer.json file

    All projects must be released on (and github).

    Note: Changes to composer.json file (specifically dev dependencies and repositories) should be mentioned in the CHANGELOG. version does not currently support semantic versioning. Instead, the version number on is 10.x-X.YZZ, where:

    • X = MAJOR
    • Y = FEATURE
    • ZZ = SPRINT (two digits - add leading zero for < 10)

    Check composer.json

    If the wxt dependent modules are updated, we need to reflect this in wxt composer.json and the CHANGELOG.

    • git clone
    • Confirm or update that it’s using appropriate tags of wxt_library + wxt_bootstrap (composer.json)
    • Push to and repositories any changes
    • Ensure GitHub Actions build passes

    Tag WxT and



    1. Go to Tags page
    2. Click … and select create release on the tag
    3. Enter the version number in the release title
    4. Copy the changelog entry for this release into the release notes
    5. Click publish release

    The builds on are incomplete as they don’t fully support Composer yet which is why we host a tarball on GitHub for those not using Composer.

    1. Drupal WxT Release Page
    2. Select the tag
    3. Copy/paste the following blurb into the release notes:
    See the <a href=""></a> file.

    2.6 - Theming

    Largely when doing any theme related work with Drupal WxT this almost always should be done in a sub-theme.

    For more on creating sub-themes please consult the official documentation:

    To assist with sub-theme creation WxT Bootstrap provides an example starterkit that should be of benefit.

    Note: Sub-themes are just like any other theme except they inherit the parent theme’s resources.

    Sub Theme Configuration

    a) Replace every instance of THEMENAME with your chosen machine name often of the pattern <prefix>_bootstrap.

    b) Enable your new sub-theme preferably via drush:

    drush en `<prefix>_bootstrap`
    drush cc css-js

    c) Point to your new sub theme for WxT Library to properly load assets under Themes Visibility on the /admin/config/wxt/wxt_library page.


    Inheriting Block Templates

    If the theme you are extending has custom block templates these won’t be immediately inherited because a sub-theme creates copies of all the blocks in the parent theme and renames them with the sub-theme’s name as a prefix. Twig block templates are derived from the block’s name, so this breaks the link between these templates and their block.

    Fixing this problem currently requires a hook in the THEMENAME.theme file and should have the following contents:

     * Implements hook_theme_suggestions_HOOK_alter().
    function THEMENAME_theme_suggestions_block_alter(&$suggestions, $variables) {
      // Load theme suggestions for blocks from parent theme.
      for ($i = 0; $i < count($suggestions); $i++) {
        if (str_contains($suggestions[$i], 'THEMENAME_')) {
          $new_suggestions = [
            str_replace('THEMENAME_', '', $suggestions[$i]),
            str_replace('THEMENAME_', 'wxt_bootstrap_', $suggestions[$i]),
          array_splice($suggestions, $i, 0, $new_suggestions);
          $i += 2;

    Programmatic Logic

    The following provides an example of how you can configure your sub theme to be installed as the default on a module install:

     * Implements hook_modules_installed().
    function MODULENAME_modules_installed($modules) {
        if (in_array('wxt', $modules)) {
            ->set('default', 'THEMENAME')
            ->set('admin', 'claro')

    The following provides an example of how you can configure wxt_library to use your sub theme by creating a config/install/wxt_library.settings.yml file with the following contents:

      visibility: 0
        - 'admin*'
        - 'imagebrowser*'
        - 'img_assist*'
        - 'imce*'
        - 'node/add/*'
        - 'node/*/edit'
        - 'print/*'
        - 'printpdf/*'
        - 'system/ajax'
        - 'system/ajax/*'
      visibility: 1
        wxt_bootstrap: wxt_bootstrap
      options: 1
        css: css
        js: js
      theme: theme-gcweb

    2.7 - Versioning

    The Drupal WxT distribution is following semantic versioning.

    WxT typically makes a sprint release every four to six weeks. We will also use sprint releases to package new minor releases of Drupal Core with WxT as they become available.

    In addition, we will also increment the major version number of WxT about once every four to six months.


    Support for semantic versioning for extensions (modules, themes, etc) is still ongoing.

    The three parts of our versioning system are MAJOR.FEATURE.SPRINT.

    Given the following tag: 10.x-2.00:

    10Major version of Drupal Core
    5Major version of WxT
    0Feature release of WxT. Also increments with minor core releases.
    0Sprint release between feature releases

    Note: Due to the constraints of, there is no separator between the FEATURE and SPRINT digits.

    3 - Environment

    This section documents best practices on how to deploy Drupal WxT to your chosen environment.

    3.1 - Containers

    For the (optional) container based development workflow this is roughly the steps that are followed.

    Clone the docker-scaffold repository:

    git clone docker

    Note: The docker folder should be added to your .gitignore file.

    Linux Environments

    The following are the steps you should follow for a Linux based environment.

    Create the necessary symlinks:

    ln -s docker/docker-compose.base.yml docker-compose.base.yml
    ln -s docker/
    ln -sf docker/docker-compose.yml docker-compose.yml

    Create and adjust the following Makefile:

    include .env
    NAME := $(or $(BASE_IMAGE),$(BASE_IMAGE),drupalwxt/site-wxt)
    VERSION := $(or $(VERSION),$(VERSION),'latest')
    PLATFORM := $(shell uname -s)
    $(eval GIT_USERNAME := $(if $(GIT_USERNAME),$(GIT_USERNAME),gitlab-ci-token))
    GET_DOCKER := $(shell [ -d docker ] || git clone $(DOCKER_REPO) docker)
    include docker/Makefile

    Build and setup your environment with default content:

    # Composer install
    export COMPOSER_MEMORY_LIMIT=-1 && composer install
    # Make our base docker image
    make build
    # Bring up the dev stack
    docker compose -f docker-compose.yml build --no-cache
    docker compose -f docker-compose.yml up -d
    # Install Drupal
    make drupal_install
    # Development configuration
    ./docker/bin/drush config-set system.performance js.preprocess 0 -y && \
    ./docker/bin/drush config-set system.performance css.preprocess 0 -y && \
    ./docker/bin/drush php-eval 'node_access_rebuild();' && \
    ./docker/bin/drush config-set wxt_library.settings wxt.theme theme-gcweb -y && \
    ./docker/bin/drush cr
    # Migrate default content
    ./docker/bin/drush migrate:import --group wxt --tag 'Core' && \
    ./docker/bin/drush migrate:import --group gcweb --tag 'Core' && \
    ./docker/bin/drush migrate:import --group gcweb --tag 'Menu'

    Modern OSX Environments

    If you have Docker for Desktop and a new enough OSX environment (Monterey or higher) then the steps are the exact same as those for the Linux environment given above.

    All that is required in advance is to enable VirtioFS accelerated directory sharing which you can see in the attached picture below.

    Docker for Desktop VirtioFS
    Image: Drupal / CC-BY-CA

    For older environments you may still use mutagen which is discussed below.

    Legacy OSX Environments (Mutagen)

    While this is fixed with the new virtualization framework discussed above.

    For older environments mutagen will have to be used instead and as such requires a few additional steps.

    # Mutagen Setup
    export VOLUME=site-wxt-mutagen-cache
    docker volume create $VOLUME
    docker container create --name $VOLUME -v $VOLUME:/volumes/$VOLUME mutagenio/sidecar:0.13.0-beta3
    docker start $VOLUME
    mutagen sync create --name $VOLUME --sync-mode=two-way-resolved --default-file-mode-beta 0666 --default-directory-mode-beta 0777  $(pwd) docker://$VOLUME/volumes/$VOLUME
    # Create symlinks
    ln -s docker/docker-compose.mutagen.yml docker-compose.mutagen.yml
    # Composer install
    export COMPOSER_MEMORY_LIMIT=-1 && composer install
    # Make our base docker image
    make build
    # Bring up the dev stack
    docker compose -f docker-compose.mutagen.yml build --no-cache
    docker compose -f docker-compose.mutagen.yml up -d
    # Install Drupal
    make drupal_install
    # Development configuration
    ./docker/bin/drush config-set system.performance js.preprocess 0 -y && \
    ./docker/bin/drush config-set system.performance css.preprocess 0 -y && \
    ./docker/bin/drush php-eval 'node_access_rebuild();' && \
    ./docker/bin/drush config-set wxt_library.settings wxt.theme theme-gcweb -y && \
    ./docker/bin/drush cr
    # Migrate default content
    ./docker/bin/drush migrate:import --group wxt --tag 'Core' && \
    ./docker/bin/drush migrate:import --group gcweb --tag 'Core' && \
    ./docker/bin/drush migrate:import --group gcweb --tag 'Menu'


    If you wish to have a pristine docker environment you may execute the following commands.

    docker rm $(docker ps -a -q) --force
    docker rmi $(docker images -q) --force
    docker volume prune -f

    For those still using Mutagen you may also need to execute the following command:

    mutagen sync terminate <sync_xxxxx>

    3.2 - Kubernetes

    Cloud Native Architecture


    This document represents a high-level technical overview of how the Helm Chart for Drupal WxT was built and how we envision Drupal itself should be architected in the cloud to support any of the Government of Canada procured cloud service providers (AWS, Azure, and GCP). It should be noted that this Helm chart would also work in an on-premise environment with the appropriate Kubernetes infrastructure.

    A key mandate when creating this architecture was to follow the Open Source Directive as given by the Treasury Board Secretariat (C.2.3.8) which states that you should try to use open standards and open source software first. Additionally, where possible all functionality should be exposed as restful services and leverage microservices via a containerized approach (C2.3.10).

    We are leveraging a microservices design pattern utilizing immutable and scanned images through containerization running on Kubernetes with a platform that has been built and open sourced by Statistics Canada. While the platform will be discussed briefly to provide context the bulk of the document discusses how Drupal is installed and configured on top of it.


    Kubernetes orchestrates the computing, networking, and storage infrastructure on behalf of user workloads. It assigns workloads and resources to a series of nearly identically-configured virtual machines.

    Kukbernetes supports workloads running anywhere, from IoT devices, to private cloud and all the way to public cloud. This is possible due to Kubernetes’ pluggable architecture, which defines interfaces that are then implemented for the different environments. Kubernetes provides an Infrastructure as Code environment defined through declarative configuration. Because Kubernetes abstracts away the implementation of the computing environment, application dependencies such as storage, networking, etc., applications do not have to concern themselves with these differences.

    Kubernetes is backed by a huge (10,000+) and vibrant growing community, consisting of end users, business, vendors and large cloud providers.

    Key Points

    This architecture brings many benefits to the Government of Canada:

    • Support for hybrid workloads (Linux and Windows), deployed using the same methodology
    • Abstraction of underlying hardware (“cattle rather than pets”) enabling an automated, highly-available and scaleable infrastructure for microservices
    • Declarative configuration enabling Infrastructure as Code allowing for deployment automation, reproducibility and re-use
    • Constructs to support advanced deployment patterns (blue/green, canary, etc.) enabling zero-downtime deployments
    • Platform-level tooling for traffic handling (routing, error recovery, encyption, etc.), monitoring, observability and logging, and secrets management

    Kubernetes is supported across all cloud service providers (fully managed and self managed), preventing vendor lock-in. Managed offerings are available from Google, IBM, Azure, Digital Ocean, Amazon, Oracle and more. The choice whether to roll your own, using a managed service (AKS, EKS, GKE) or a Platform as a Service (OpenShift, Pivotal) is up to the organization to decide based on their requirements and risks. Our preference is to stay as close as possible to the open source version of Kubernetes as well as tooling in order to remain compatible with the different Kubernetes offerings (raw, managed, platform, etc.).


    Kubernetes is being actively investigated and/or used by many departments across the Government of Canada. Departments are starting to collaborate more and work together towards a common, well-vetted solution and this is why we have have Open Sourced our platform on the GC Accelerators hoping to foster this collaboration and form a community of practice.

    Provided below is the Terraform (Infrastructure as Code) necessarily to install the Azure Kubernetes Service Infrastructure as well as configure with optional platform components (RBAC, Service Mesh, Policies, etc).

    Drupal WxT on Kubernetes

    A managed Drupal Platform as a Service is a strong candidate to take advantage of what a Kubernetes platform offers. The design enables a quick onboarding of new workloads through the repeatable deployment methodology provided by Kubernetes.


    Recommendation: Kubernetes

    Kubernetes is the basis of the Drupal platform and was further discussed above.

    The whole Drupal application stack can be easily installed in a distributed fashion in minutes using our Helm chart, The chart facilitates a managed service workflow (rolling updates, cronjobs, health checks, auto-scaling, etc.) without user intervention.

    Ingress controller

    Recommendation: Istio

    The ingress controller is responsible for accepting external HTTPS connections and routing them to backend applications based on configuration defined in Kubernetes Ingress objects. Routing can be done by domain and/or path.


    Recommendation: Varnish

    Varnish is a highly customizable reverse proxy cache. This will aid in supporting a large number of concurrent visitors as the final rendered pages can be served from cache. Varnish is only required on the public environment and is not used in the content staging environment.

    Nginx can technically address some of the cache requirements needed, however the open source version does not support purging selective pages. We need to clear caches based on content being updated / saved which Varnish supports along with the Expire Drupal module quite readily


    Recommendation: Nginx

    Nginx is an open source web server that can also be used a reverse proxy, HTTP cache, and load balancer. Due to its root in performance optimization under scale, Nginx often outperforms similarly popular web servers and is built to offer low memory usage, and high concurrency.

    Web (PHP-FPM)

    Recommendation: PHP-FPM

    Drupal runs in the PHP runtime environment. PHP-FPM is the process manager organized as a master process managing pools of individual worker processes. Its architecture shares design similarities with event-driven web servers such as Nginx and allows for PHP scripts to use as much of the server's available resources as necessary without additional overhead that comes from running them inside of web server processes.

    The PHP-FPM master process dynamically creates and terminates worker processes (within configurable limits) as traffic to PHP scripts increases and decreases. Processing scripts in this way allows for much higher processing performance, improved security, and better stability. The primary performance benefits from using PHP-FPM are more efficient PHP handling and ability to use opcode caching.


    Recommendation: Redis

    Redis is an advanced key-value cache and store.

    It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets, sorted sets, bitmaps, etc.

    Redis is particularly useful when using cloud managed databases to limit the overall database load and to make performance more consistent.


    Recommendation: MySQL or PostgreSQL

    Drupal maintains its state in a database and while supports several types only MySQL or PostgreSQL should be considered. Personally, we highly recommend PostgreSQL based on the experience we had building / launching quite a few Drupal sites in the cloud with it. However both run quite well with minimal operational concerns. Additionally the Helm Chart supports connection pooling using either ProxySQL and / or PGBouncer depending on the database used.

    Note: Our recommendation would be to use a managed database offering from the cloud providers for a production environment. Coupled with a managed file service, this removes all stateful components from the cluster enabling the best application experience possible.

    Stateful Assets

    Drupal stores generated CSS/JS assets and uploaded content (images, videos, etc.) in a file storage. As the architecture is designed to be distributed, this present some design considerations for us.

    Azure Files (CIFS / NFS)

    Fully managed file shares in the cloud that are accessible via Server Message Block (SMB) or NFS protocol. Support is provided for dynamically creating and using a persistent volume with Azure Files in the Azure Kubernetes Service.

    For more information on Azure Files, please see Azure Files and AKS.

    Note: This is currently our recommended choice as it results in a simpler installation in Azure then relying on an S3 compatible object store discussed below. Similar storage solutions exist with the other cloud providers.