From 7f745604cb6496c699f3dc62b561d8a3df04a9ae Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Wed, 28 Oct 2026 23:27:57 +0100 Subject: [PATCH 1/3] fix(web-app-fusiondirectory): mount the shared PHP hardening ini FusionDirectory was the one PHP role #1115 left without the shared hardening ini, so its PHP 7.4 kept session.upload_progress enabled and a finite memory_limit, the two settings behind CVE-2026-109619 and CVE-2026-109618. The nfrastack image runs Alpine's php7 with /etc/php7/conf.d as scan dir. Its init only links module inis there and chmods/chowns the tree; php-ext reset, which empties conf.d, runs at build time only. A read-only config at conf.d/zz-infinito-hardening.ini therefore survives the init and loads after 99-*.ini, so it wins. The PHP line itself stays on 7.4: FusionDirectory certifies 1.4 to 1.6 for PHP 7.4 only, nfrastack/container-fusiondirectory builds only on PHP 7.4 and Alpine 3.15, and the PHP 8 port is upstream's unreleased php8 branch. TODO.md records that state and the options. The php_hardening entry sits above data in meta/volumes.yml and the TODO note replaces only the mounted item, so the pending feature/store-i18n changes to both files still merge cleanly. Refs #1120 Co-Authored-By: Claude Opus 5.5 --- roles/web-app-fusiondirectory/TODO.md | 2 +- roles/web-app-fusiondirectory/meta/volumes.yml | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/roles/web-app-fusiondirectory/TODO.md b/roles/web-app-fusiondirectory/TODO.md index dc647a5fa8..f20419e2c3 100644 --- a/roles/web-app-fusiondirectory/TODO.md +++ b/roles/web-app-fusiondirectory/TODO.md @@ -1,4 +1,4 @@ # To-dos - Move off PHP 7.4. The pinned `nfrastack/fusiondirectory:1.5` image builds on `ghcr.io/nfrastack/container-nginx-php-fpm` with PHP 7.4 on Alpine 3.15, which is end of life and gets no fix for CVE-2026-109618 and CVE-2026-109619. -- Mount the shared PHP hardening ini (`FILE_PHP_HARDENING_INI`) once the image's scan dir is verified. The nfrastack init scripts manage `conf.d` at runtime, so a read-only mount there has to be tested before it ships. + - No FusionDirectory release runs on a supported PHP yet: upstream certifies 1.4 to 1.6 for PHP 7.4 only, `nfrastack/container-fusiondirectory` builds its image only on PHP 7.4 and Alpine 3.15, and the PHP 8 port lives on upstream's unreleased `php8` branch. Until then the shared hardening ini mounted at `/etc/php7/conf.d/zz-infinito-hardening.ini` carries the mitigations for both CVEs. Options: rebuild the image on upstream's first `php8` release, or build `nfrastack/container-fusiondirectory` against a pinned `php8` commit on `container-nginx-php-fpm` 8.4 before that release. diff --git a/roles/web-app-fusiondirectory/meta/volumes.yml b/roles/web-app-fusiondirectory/meta/volumes.yml index 8f7f900245..ed9d3576c1 100644 --- a/roles/web-app-fusiondirectory/meta/volumes.yml +++ b/roles/web-app-fusiondirectory/meta/volumes.yml @@ -1,4 +1,11 @@ --- +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: fusiondirectory + target: /etc/php7/conf.d/zz-infinito-hardening.ini # nocheck: embedded-state-on-nfs generated asset cache; the authoritative state lives in LDAP data: type: volume From 2f92e942549661aa9f4e18be29852def30b4e75c Mon Sep 17 00:00:00 2001 From: "infinito-nexus-updater[bot]" <286144613+infinito-nexus-updater[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 07:18:20 +0000 Subject: [PATCH 2/3] update(repos): bump git refs to latest semver tags (web-app-bluesky) --- roles/web-app-bluesky/meta/services.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/web-app-bluesky/meta/services.yml b/roles/web-app-bluesky/meta/services.yml index 47083d70fa..0720d92266 100644 --- a/roles/web-app-bluesky/meta/services.yml +++ b/roles/web-app-bluesky/meta/services.yml @@ -62,7 +62,7 @@ web: view: enabled: false repository: https://github.com/bluesky-social/social-app.git - ref: "1.136.0" + ref: "1.137.0" ports: local: http: 8051 From 5a81c8db5f9e66b55e5d90d1b0ff17b13532a8ba Mon Sep 17 00:00:00 2001 From: "infinito-nexus-updater[bot]" <286144613+infinito-nexus-updater[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 07:19:46 +0000 Subject: [PATCH 3/3] update(images): update Docker image versions (svc-ai-ollama) --- roles/svc-ai-ollama/meta/services.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/svc-ai-ollama/meta/services.yml b/roles/svc-ai-ollama/meta/services.yml index 1c39365e90..2089464ef3 100644 --- a/roles/svc-ai-ollama/meta/services.yml +++ b/roles/svc-ai-ollama/meta/services.yml @@ -13,7 +13,7 @@ ollama: backup: no_stop_required: true image: ollama/ollama - version: 0.40.12 + version: 0.40.13 name: ollama min_storage: 3473MB cpus: "4.0"