Merge pull request #1263 from infinito-nexus/fix/web-app-fusiondirectory/php-hardening/1120

fix(web-app-fusiondirectory): mount the shared PHP hardening ini

roles/web-app-fusiondirectory/TODO.md

@@ -1,4 +1,4 @@
 # To-dos
 
 - Move off PHP 7.4. The pinned `nfrastack/fusiondirectory:1.5` image builds on `ghcr.io/nfrastack/container-nginx-php-fpm` with PHP 7.4 on Alpine 3.15, which is end of life and gets no fix for CVE-2026-109618 and CVE-2026-109619.
-- Mount the shared PHP hardening ini (`FILE_PHP_HARDENING_INI`) once the image's scan dir is verified. The nfrastack init scripts manage `conf.d` at runtime, so a read-only mount there has to be tested before it ships.
+  - No FusionDirectory release runs on a supported PHP yet: upstream certifies 1.4 to 1.6 for PHP 7.4 only, `nfrastack/container-fusiondirectory` builds its image only on PHP 7.4 and Alpine 3.15, and the PHP 8 port lives on upstream's unreleased `php8` branch. Until then the shared hardening ini mounted at `/etc/php7/conf.d/zz-infinito-hardening.ini` carries the mitigations for both CVEs. Options: rebuild the image on upstream's first `php8` release, or build `nfrastack/container-fusiondirectory` against a pinned `php8` commit on `container-nginx-php-fpm` 8.4 before that release.

roles/web-app-fusiondirectory/meta/volumes.yml

@@ -1,4 +1,11 @@
 ---
+php_hardening:
+  type: config
+  source: "{{ FILE_PHP_HARDENING_INI }}"
+  mode: "0444"
+  mounts:
+    - service: fusiondirectory
+      target: /etc/php7/conf.d/zz-infinito-hardening.ini
 # nocheck: embedded-state-on-nfs generated asset cache; the authoritative state lives in LDAP
 data:
   type: volume