diff --git a/TODO.md b/TODO.md index 48cc42d59f..e5edb52ecf 100644 --- a/TODO.md +++ b/TODO.md @@ -4,6 +4,7 @@ - Implement rbac administration interface - Enable IP6 for docker. - backup docker to local fΓΌr ca optimieren +- Drop `memory_limit = -1` from [hardening.ini](roles/sys-svc-compose-php/files/hardening.ini) once every PHP image ships PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. It is the interim mitigation for CVE-2026-109618 and overrides the per-role `service_memory_mb` share, so a single request can exhaust the container instead of hitting a PHP limit. `web-app-joomla` keeps its own `memory_limit` because its media API compares uploads against it, and `web-app-magento` keeps the 756M its `nginx.conf.sample` (`PHP_VALUE`) and `pub/.user.ini` set; both keep `post_max_size` below a quarter of that limit. While the override is in place, `web-app-nextcloud` (`upload_limit` 5G at 3g) accepts POST bodies above a quarter of its container memory, `web-app-friendica` caps account imports at 64 MiB instead of half the memory limit, EspoCRM's System Requirements page flags `memory_limit` as failed, and Pixelfed (`InstanceService`), phpMyAdmin (import and export) and Snipe-IT (imports and LDAP sync) set a finite limit again via `ini_set` after the request has started. - Fork [rpardini/docker-registry-proxy](https://github.com/rpardini/docker-registry-proxy) and teach the bundled nginx to handle GCP Artifact Registry redirect URLs (`/artifacts-downloads/namespaces//repositories//downloads/`). Currently `gcr.io` blob pulls are bypassed via `NO_PROXY=…,gcr.io,storage.googleapis.com,googleusercontent.com` in [compose/registry-cache/proxy.conf](compose/registry-cache/proxy.conf), which is a workaround that disables caching for those registries. Long-term: rebase upstream's `proxy.conf` / `sub_filter` rules to recognise the new redirect shape, ship the fix in our fork, point `compose/registry-cache/Dockerfile` (or its image tag) at the fork, and drop the `NO_PROXY` bypass. ## Testing diff --git a/group_vars/all/05_paths.yml b/group_vars/all/05_paths.yml index c9f8cbe1e9..9683796ccf 100644 --- a/group_vars/all/05_paths.yml +++ b/group_vars/all/05_paths.yml @@ -29,6 +29,12 @@ FILE_DATABASE_SECRETS: "{{ [DIR_SECRETS, 'databases.csv'] | path_join }}" DIR_METRICS_TEXTFILE: "{{ [DIR_VAR_LIB, 'metrics'] | path_join }}" +DIR_PHP_HARDENING: "/etc/{{ SOFTWARE_DOMAIN }}/php" +PHP_HARDENING_INI_DIGEST: "{{ (lookup('file', lookup('path_absolute', 'roles/sys-svc-compose-php/files/hardening.ini')) | hash('sha1'))[:8] }}" +PHP_FPM_HARDENING_CONF_DIGEST: "{{ (lookup('template', lookup('path_absolute', 'roles/sys-svc-compose-php/templates/fpm-hardening.conf.j2')) | hash('sha1'))[:8] }}" +FILE_PHP_HARDENING_INI: "{{ [DIR_PHP_HARDENING, 'hardening-' ~ PHP_HARDENING_INI_DIGEST ~ '.ini'] | path_join }}" +FILE_PHP_FPM_HARDENING_CONF: "{{ [DIR_PHP_HARDENING, 'fpm-hardening-' ~ PHP_FPM_HARDENING_CONF_DIGEST ~ '.conf'] | path_join }}" + DIR_RESCUE_DIAGNOSTICS: "/tmp/infinito-rescue-diagnostics" FILE_DNS53_SAMPLER_LOG: "/var/log/infinito/dns53-sampler.log" diff --git a/group_vars/all/17_resource.yml b/group_vars/all/17_resource.yml index 4392f54ade..9facac24fe 100644 --- a/group_vars/all/17_resource.yml +++ b/group_vars/all/17_resource.yml @@ -49,4 +49,6 @@ POSTGRES_SUPERUSER_RESERVED_CONNECTIONS: 3 POSTGRES_MAX_LOCKS_PER_TRANSACTION: 256 POSTGRES_DELAY: 2 +PHP_FPM_MAX_REQUESTS: 200 + TIMEOUT_FACTOR: 1 diff --git a/roles/sys-front-tls/templates/nginx_ssl_header.j2 b/roles/sys-front-tls/templates/nginx_ssl_header.j2 index 4ed2b5e9b2..6fc4b4f1a7 100644 --- a/roles/sys-front-tls/templates/nginx_ssl_header.j2 +++ b/roles/sys-front-tls/templates/nginx_ssl_header.j2 @@ -11,7 +11,7 @@ ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets on; -add_header Strict-Transport-Security max-age=15768000 always; +add_header Strict-Transport-Security max-age=31536000 always; ssl_stapling on; ssl_stapling_verify on; diff --git a/roles/sys-svc-compose-php/README.md b/roles/sys-svc-compose-php/README.md new file mode 100644 index 0000000000..c908bc9196 --- /dev/null +++ b/roles/sys-svc-compose-php/README.md @@ -0,0 +1,39 @@ +# sys-svc-compose-php + +## Description + +Internal helper role that installs the shared PHP hardening assets on the +stack host. PHP services of Docker Compose and Swarm stacks mount them as +configs from their own `meta/volumes.yml`. + +## Overview + +This role installs one PHP ini (`FILE_PHP_HARDENING_INI`) and one PHP-FPM pool +drop-in (`FILE_PHP_FPM_HARDENING_CONF`). A PHP role opts in by declaring a +`type: config` entry with that file as `source` and a file inside the scan dir +of its image as `target`, e.g. `conf.d/zz-infinito-hardening.ini` or, for the +pool, `php-fpm.d/zz-infinito-hardening.conf`. + +## Cosmos + +The diagram places sys-svc-compose-php in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks). + +```mermaid +flowchart LR + subgraph role [sys-svc-compose-php πŸ’»] + svc_svc_compose_php["svc-compose-php"] + end +``` + +Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (enabled only in matching deployments); red `0..0` edges are turned off in this role. Node markers show the role's deploy modes (πŸ’» host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and βš™οΈ an Ansible role dependency declared in `meta/main.yml`. + +## Features + +- **PHP ini hardening:** `expose_php` off; `session.upload_progress.enabled = 0` and, on PHP 8.5 only, `fatal_error_backtraces = 0` against CVE-2026-109619; the interim `memory_limit = -1` against CVE-2026-109618. +- **PHP-FPM worker recycling:** `pm.max_requests` from `PHP_FPM_MAX_REQUESTS` for images whose `[www]` pool reads `php-fpm.d/*.conf`. + +## Credits + +Implemented by **[Kevin Veen-Birkenbach](https://www.veen.world)**. +Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code) and maintained by [Kevin Veen-Birkenbach](https://www.veen.world). +Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license). diff --git a/roles/sys-svc-compose-php/files/hardening.ini b/roles/sys-svc-compose-php/files/hardening.ini new file mode 100644 index 0000000000..2e5a25ec09 --- /dev/null +++ b/roles/sys-svc-compose-php/files/hardening.ini @@ -0,0 +1,4 @@ +expose_php = Off +session.upload_progress.enabled = 0 +fatal_error_backtraces = 0 +memory_limit = -1 diff --git a/roles/sys-svc-compose-php/meta/main.yml b/roles/sys-svc-compose-php/meta/main.yml new file mode 100644 index 0000000000..87d860482a --- /dev/null +++ b/roles/sys-svc-compose-php/meta/main.yml @@ -0,0 +1,32 @@ +--- +galaxy_info: + author: Kevin Veen-Birkenbach + description: Shared PHP hardening ini and PHP-FPM pool drop-in that PHP services of compose and swarm stacks mount as configs + license: Infinito.Nexus Community License (Non-Commercial) + company: | + Kevin Veen-Birkenbach + https://www.veen.world + galaxy_tags: + - docker + - compose + - php + - security + - hardening + issue_tracker_url: https://s.infinito.nexus/issues + min_ansible_version: "2.9" + platforms: + - name: ArchLinux + versions: + - all + - name: Debian + versions: + - all + - name: EL + versions: + - all + - name: Fedora + versions: + - all + - name: Ubuntu + versions: + - all diff --git a/roles/sys-svc-compose-php/meta/services.yml b/roles/sys-svc-compose-php/meta/services.yml new file mode 100644 index 0000000000..bc7ec96ead --- /dev/null +++ b/roles/sys-svc-compose-php/meta/services.yml @@ -0,0 +1,8 @@ +--- +svc-compose-php: + lifecycle: beta + required_by: + compose: + categories: [web] + swarm: + categories: [web] diff --git a/roles/sys-svc-compose-php/tasks/00_core.yml b/roles/sys-svc-compose-php/tasks/00_core.yml new file mode 100644 index 0000000000..c974b5eee9 --- /dev/null +++ b/roles/sys-svc-compose-php/tasks/00_core.yml @@ -0,0 +1,29 @@ +--- +- name: "πŸ“ PHP hardening | ensure directory exists" + become: true + ansible.builtin.file: + path: "{{ DIR_PHP_HARDENING }}" + state: directory + mode: "0755" + owner: root + group: root + +- name: "πŸ›‘οΈ PHP hardening | install ini" + become: true + stack_host_copy: + src: "hardening.ini" + dest: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + owner: root + group: root + +- name: "πŸ›‘οΈ PHP hardening | render FPM pool" + become: true + stack_host_template: + src: "fpm-hardening.conf.j2" + dest: "{{ FILE_PHP_FPM_HARDENING_CONF }}" + mode: "0444" + owner: root + group: root + +- include_tasks: utils/once/flag.yml diff --git a/roles/sys-svc-compose-php/tasks/main.yml b/roles/sys-svc-compose-php/tasks/main.yml new file mode 100644 index 0000000000..8a06eb65a2 --- /dev/null +++ b/roles/sys-svc-compose-php/tasks/main.yml @@ -0,0 +1,3 @@ +--- +- include_tasks: 00_core.yml + when: run_once_sys_svc_compose_php is not defined diff --git a/roles/sys-svc-compose-php/templates/fpm-hardening.conf.j2 b/roles/sys-svc-compose-php/templates/fpm-hardening.conf.j2 new file mode 100644 index 0000000000..2a6019f93f --- /dev/null +++ b/roles/sys-svc-compose-php/templates/fpm-hardening.conf.j2 @@ -0,0 +1,2 @@ +[www] +pm.max_requests = {{ PHP_FPM_MAX_REQUESTS }} diff --git a/roles/sys-svc-compose/tasks/02_stack_host_prep.yml b/roles/sys-svc-compose/tasks/02_stack_host_prep.yml index 051a2bb18a..37631527a3 100644 --- a/roles/sys-svc-compose/tasks/02_stack_host_prep.yml +++ b/roles/sys-svc-compose/tasks/02_stack_host_prep.yml @@ -6,6 +6,10 @@ mode: "0755" with_dict: "{{ lookup('container', application_id, 'directories') }}" +- name: "πŸ›‘οΈ Ensure PHP hardening assets are installed" + ansible.builtin.include_role: + name: sys-svc-compose-php + - name: "πŸ“‚ Include git-repo based installation routines for '{{ application_id }}'." include_tasks: "03_repository.yml" when: compose_repository_pull | bool diff --git a/roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2 b/roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2 index cb1b7e2a13..d01d61cdac 100644 --- a/roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2 +++ b/roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2 @@ -14,3 +14,4 @@ proxy_hide_header X-Frame-Options; proxy_hide_header X-XSS-Protection; proxy_hide_header X-Download-Options; proxy_hide_header X-Permitted-Cross-Domain-Policies; +proxy_hide_header X-Powered-By; diff --git a/roles/sys-svc-webserver-core/templates/nginx.conf.j2 b/roles/sys-svc-webserver-core/templates/nginx.conf.j2 index 7ee2aaa105..e8cfe19861 100644 --- a/roles/sys-svc-webserver-core/templates/nginx.conf.j2 +++ b/roles/sys-svc-webserver-core/templates/nginx.conf.j2 @@ -19,6 +19,7 @@ http } include mime.types; default_type text/html; + server_tokens off; add_header 'Vary' 'Origin' always; proxy_cache_path {{ lookup('nginx','directories.cache.general') }} levels=1:2 keys_zone=cache:20m max_size=20g inactive=14d use_temp_path=off; proxy_cache_path {{ lookup('nginx','directories.cache.image') }} levels=1:2 keys_zone=imgcache:10m inactive=60m use_temp_path=off; diff --git a/roles/web-app-akaunting/TODO.md b/roles/web-app-akaunting/TODO.md index 08cc6561fb..437f188b19 100644 --- a/roles/web-app-akaunting/TODO.md +++ b/roles/web-app-akaunting/TODO.md @@ -1,4 +1,5 @@ # To-dos - Enable OIDC +- Move off PHP 8.1. The role builds the image from `akaunting/docker` (`master`), whose Dockerfile starts `FROM php:8.1-apache` and runs PHP 8.1.34, which is end of life and gets no upstream fix for CVE-2026-109618 and CVE-2026-109619. Build on a PHP 8.2 or later base instead. - Add OIDC auto-provisioning so a fresh Keycloak user that lands on the akaunting tile lands on a working akaunting user account instead of a "no permission" surface. Until that is wired, BOTH the playwright biber and administrator personas are blocked via `PERSONA_BIBER_BLOCKED=true` and `PERSONA_ADMINISTRATOR_BLOCKED=true` in `templates/playwright.env.j2` (req 019 Rule 11 explicit opt-out). Once auto-provisioning works, drop both opt-out flags so the personas drive the real journey. diff --git a/roles/web-app-akaunting/meta/volumes.yml b/roles/web-app-akaunting/meta/volumes.yml index 285c180388..cb9b9ae88c 100644 --- a/roles/web-app-akaunting/meta/volumes.yml +++ b/roles/web-app-akaunting/meta/volumes.yml @@ -5,3 +5,10 @@ data: mounts: - service: akaunting target: /var/www/html +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: akaunting + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-espocrm/meta/volumes.yml b/roles/web-app-espocrm/meta/volumes.yml index af4f0557eb..b611677e28 100644 --- a/roles/web-app-espocrm/meta/volumes.yml +++ b/roles/web-app-espocrm/meta/volumes.yml @@ -31,3 +31,10 @@ client_custom: target: *var_www_html_client_custom_target - service: websocket target: *var_www_html_client_custom_target +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: espocrm + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-friendica/meta/volumes.yml b/roles/web-app-friendica/meta/volumes.yml index a6fceae867..58344c4e77 100644 --- a/roles/web-app-friendica/meta/volumes.yml +++ b/roles/web-app-friendica/meta/volumes.yml @@ -19,3 +19,10 @@ ldapauth_config: - service: friendica target: /var/www/html/config/ldapauth.config.php when: "{{ lookup('config', 'web-app-friendica', 'services.ldap.enabled') | bool }}" +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: friendica + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-fusiondirectory/TODO.md b/roles/web-app-fusiondirectory/TODO.md new file mode 100644 index 0000000000..dc647a5fa8 --- /dev/null +++ b/roles/web-app-fusiondirectory/TODO.md @@ -0,0 +1,4 @@ +# To-dos + +- Move off PHP 7.4. The pinned `nfrastack/fusiondirectory:1.5` image builds on `ghcr.io/nfrastack/container-nginx-php-fpm` with PHP 7.4 on Alpine 3.15, which is end of life and gets no fix for CVE-2026-109618 and CVE-2026-109619. +- Mount the shared PHP hardening ini (`FILE_PHP_HARDENING_INI`) once the image's scan dir is verified. The nfrastack init scripts manage `conf.d` at runtime, so a read-only mount there has to be tested before it ships. diff --git a/roles/web-app-joomla/meta/volumes.yml b/roles/web-app-joomla/meta/volumes.yml index 74cbd3b68c..f9bbb1d80c 100644 --- a/roles/web-app-joomla/meta/volumes.yml +++ b/roles/web-app-joomla/meta/volumes.yml @@ -12,4 +12,12 @@ php_upload: mode: "0444" mounts: - service: joomla - target: /usr/local/etc/php/conf.d/uploads.ini + target: /usr/local/etc/php/conf.d/zzz-joomla-uploads.ini + +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: joomla + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-keycloak/TODO.md b/roles/web-app-keycloak/TODO.md index 52760911f6..ca648c8906 100644 --- a/roles/web-app-keycloak/TODO.md +++ b/roles/web-app-keycloak/TODO.md @@ -2,6 +2,7 @@ - Implement working logout for all applications - Implement general logout button +- Restrict the admin console. `https://auth./` redirects to `/admin/`, which any client on the internet can reach. Add a source-network allowlist for `/admin` in the proxy vhost. ## Req 019 rollout: deploy gate diff --git a/roles/web-app-lam/meta/volumes.yml b/roles/web-app-lam/meta/volumes.yml new file mode 100644 index 0000000000..15633aec53 --- /dev/null +++ b/roles/web-app-lam/meta/volumes.yml @@ -0,0 +1,8 @@ +--- +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: lam + target: /etc/php/8.4/apache2/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-lam/templates/compose.yml.j2 b/roles/web-app-lam/templates/compose.yml.j2 index 5baa929014..7e5ca346a5 100644 --- a/roles/web-app-lam/templates/compose.yml.j2 +++ b/roles/web-app-lam/templates/compose.yml.j2 @@ -5,6 +5,7 @@ {{ lookup('compose_only', 'container_name', LAM_CONTAINER) }} {{ lookup('container_image', application_id, 'lam') }} {{ lookup('container_ports', ['lam', 'http', DOCKER_BIND_HOST]) | indent(4) }} + {{ lookup('container_volumes', service_name) | indent(4) }} {% include 'roles/sys-svc-container/templates/base.yml.j2' %} {{ lookup('container_networks') | indent(4) }} diff --git a/roles/web-app-magento/meta/volumes.yml b/roles/web-app-magento/meta/volumes.yml index 1c21edeafe..8fceecaa8a 100644 --- a/roles/web-app-magento/meta/volumes.yml +++ b/roles/web-app-magento/meta/volumes.yml @@ -23,3 +23,11 @@ php_fpm_conf: mounts: - service: php target: /usr/local/etc/php-fpm.conf + +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: php + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-mailu/meta/volumes.yml b/roles/web-app-mailu/meta/volumes.yml index aeeb622397..8616ec60f4 100644 --- a/roles/web-app-mailu/meta/volumes.yml +++ b/roles/web-app-mailu/meta/volumes.yml @@ -83,3 +83,10 @@ rspamd_overrides: mounts: - service: antispam target: *overrides_target +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: webmail + target: /etc/php83/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-matomo/meta/volumes.yml b/roles/web-app-matomo/meta/volumes.yml index 68b179d9ed..d896341e85 100644 --- a/roles/web-app-matomo/meta/volumes.yml +++ b/roles/web-app-matomo/meta/volumes.yml @@ -15,3 +15,11 @@ tmp: mounts: - service: matomo target: /var/www/html/tmp + +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: matomo + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-mediawiki/meta/volumes.yml b/roles/web-app-mediawiki/meta/volumes.yml index 2e19976e28..edfa48f3c5 100644 --- a/roles/web-app-mediawiki/meta/volumes.yml +++ b/roles/web-app-mediawiki/meta/volumes.yml @@ -29,3 +29,11 @@ mw_local: - service: mediawiki target: /opt/mw-local read_only: true + +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: mediawiki + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-moodle/meta/volumes.yml b/roles/web-app-moodle/meta/volumes.yml index 6019189890..30e93b36cc 100644 --- a/roles/web-app-moodle/meta/volumes.yml +++ b/roles/web-app-moodle/meta/volumes.yml @@ -49,3 +49,17 @@ msmtprc: target: &etc_msmtprc_target /etc/msmtprc - service: cron target: *etc_msmtprc_target +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: moodle + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini +php_fpm_hardening: + type: config + source: "{{ FILE_PHP_FPM_HARDENING_CONF }}" + mode: "0444" + mounts: + - service: moodle + target: /usr/local/etc/php-fpm.d/zz-infinito-hardening.conf diff --git a/roles/web-app-nextcloud/meta/volumes.yml b/roles/web-app-nextcloud/meta/volumes.yml index ad65b6b229..364cc4d6b0 100644 --- a/roles/web-app-nextcloud/meta/volumes.yml +++ b/roles/web-app-nextcloud/meta/volumes.yml @@ -60,3 +60,19 @@ infinito_conf: target: &var_www_infinito_target /var/www/infinito/ - service: cron target: *var_www_infinito_target + +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: nextcloud + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini + +php_fpm_hardening: + type: config + source: "{{ FILE_PHP_FPM_HARDENING_CONF }}" + mode: "0444" + mounts: + - service: nextcloud + target: /usr/local/etc/php-fpm.d/zz-infinito-hardening.conf diff --git a/roles/web-app-phpldapadmin/meta/volumes.yml b/roles/web-app-phpldapadmin/meta/volumes.yml new file mode 100644 index 0000000000..df9e69ec7e --- /dev/null +++ b/roles/web-app-phpldapadmin/meta/volumes.yml @@ -0,0 +1,8 @@ +--- +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: phpldapadmin + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-phpldapadmin/templates/compose.yml.j2 b/roles/web-app-phpldapadmin/templates/compose.yml.j2 index a858409c74..99034013b1 100644 --- a/roles/web-app-phpldapadmin/templates/compose.yml.j2 +++ b/roles/web-app-phpldapadmin/templates/compose.yml.j2 @@ -6,6 +6,7 @@ {{ lookup('compose_only', 'container_name', application_id) }} {{ lookup('container_image', application_id, 'phpldapadmin') }} {{ lookup('container_ports', ['phpldapadmin', 'http', DOCKER_BIND_HOST]) | indent(4) }} + {{ lookup('container_volumes', service_name) | indent(4) }} {% include 'roles/sys-svc-container/templates/base.yml.j2' %} {{ lookup('container_networks') | indent(4) }} diff --git a/roles/web-app-phpmyadmin/meta/volumes.yml b/roles/web-app-phpmyadmin/meta/volumes.yml new file mode 100644 index 0000000000..5c220c9994 --- /dev/null +++ b/roles/web-app-phpmyadmin/meta/volumes.yml @@ -0,0 +1,8 @@ +--- +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: phpmyadmin + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-phpmyadmin/templates/compose.yml.j2 b/roles/web-app-phpmyadmin/templates/compose.yml.j2 index 2bfbc92702..c8c1e34b47 100644 --- a/roles/web-app-phpmyadmin/templates/compose.yml.j2 +++ b/roles/web-app-phpmyadmin/templates/compose.yml.j2 @@ -6,6 +6,7 @@ {{ lookup('compose_only', 'container_name', PHPMYADMIN_CONTAINER) }} {% include 'roles/sys-svc-container/templates/base.yml.j2' %} {{ lookup('container_ports', ['phpmyadmin', 'http', DOCKER_BIND_HOST]) | indent(4) }} + {{ lookup('container_volumes', service_name) | indent(4) }} {{ lookup('container_depends_on', application_id) | indent(4) }} {{ lookup('container_networks') | indent(4) }} {{ lookup('container_healthcheck', service_name) | indent(4) }} diff --git a/roles/web-app-pixelfed/meta/volumes.yml b/roles/web-app-pixelfed/meta/volumes.yml index 2513c9bbf6..929a9d72a2 100644 --- a/roles/web-app-pixelfed/meta/volumes.yml +++ b/roles/web-app-pixelfed/meta/volumes.yml @@ -33,3 +33,11 @@ worker_entrypoint: mounts: - service: worker target: /infinito-pixelfed-worker-entrypoint.sh + +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: pixelfed + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-shopware/meta/volumes.yml b/roles/web-app-shopware/meta/volumes.yml index 5037fc5db6..021a1a0809 100644 --- a/roles/web-app-shopware/meta/volumes.yml +++ b/roles/web-app-shopware/meta/volumes.yml @@ -122,3 +122,19 @@ adminopenauth_yaml: target: *var_www_html_config_packages_adminopenauth_yaml_target - service: scheduler target: *var_www_html_config_packages_adminopenauth_yaml_target + +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: web + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini + +php_fpm_hardening: + type: config + source: "{{ FILE_PHP_FPM_HARDENING_CONF }}" + mode: "0444" + mounts: + - service: web + target: /usr/local/etc/php-fpm.d/zz-infinito-hardening.conf diff --git a/roles/web-app-snipe-it/meta/volumes.yml b/roles/web-app-snipe-it/meta/volumes.yml index c7a05092a8..6a0c27d8be 100644 --- a/roles/web-app-snipe-it/meta/volumes.yml +++ b/roles/web-app-snipe-it/meta/volumes.yml @@ -13,3 +13,11 @@ env: mounts: - service: snipe-it target: /var/www/html/.env + +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: snipe-it + target: /etc/php84/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-stalwart/meta/volumes.yml b/roles/web-app-stalwart/meta/volumes.yml index 4fcb41ef57..aa3023e1fe 100644 --- a/roles/web-app-stalwart/meta/volumes.yml +++ b/roles/web-app-stalwart/meta/volumes.yml @@ -59,3 +59,10 @@ webmail_oauth: mounts: - service: webmail target: /var/roundcube/config/oauth.inc.php +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: webmail + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-suitecrm/meta/volumes.yml b/roles/web-app-suitecrm/meta/volumes.yml index 652e82b8a6..f0454f2dbe 100644 --- a/roles/web-app-suitecrm/meta/volumes.yml +++ b/roles/web-app-suitecrm/meta/volumes.yml @@ -30,3 +30,10 @@ ldap_config: - service: suitecrm target: "{{ ['/var/www/html/extensions', SOFTWARE_DOMAIN | replace('.', '-'), 'config/services/ldap/ldap.yaml'] | path_join }}" when: "{{ lookup('config', 'web-app-suitecrm', 'services.ldap.enabled') | bool }}" +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: suitecrm + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-wordpress/meta/volumes.yml b/roles/web-app-wordpress/meta/volumes.yml index cd49d33ca6..761b065f50 100644 --- a/roles/web-app-wordpress/meta/volumes.yml +++ b/roles/web-app-wordpress/meta/volumes.yml @@ -12,3 +12,10 @@ msmtprc: mounts: - service: wordpress target: /etc/msmtprc +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: wordpress + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-yourls/meta/volumes.yml b/roles/web-app-yourls/meta/volumes.yml new file mode 100644 index 0000000000..7d58bd0a7f --- /dev/null +++ b/roles/web-app-yourls/meta/volumes.yml @@ -0,0 +1,8 @@ +--- +php_hardening: + type: config + source: "{{ FILE_PHP_HARDENING_INI }}" + mode: "0444" + mounts: + - service: yourls + target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini diff --git a/roles/web-app-yourls/templates/compose.yml.j2 b/roles/web-app-yourls/templates/compose.yml.j2 index 493804d31f..d2634c4e62 100644 --- a/roles/web-app-yourls/templates/compose.yml.j2 +++ b/roles/web-app-yourls/templates/compose.yml.j2 @@ -9,6 +9,7 @@ {{ lookup('compose_only', 'container_name', YOURLS_CONTAINER) }} {% include 'roles/sys-svc-container/templates/base.yml.j2' %} {{ lookup('container_ports', ['yourls', 'http', DOCKER_BIND_HOST]) | indent(4) }} + {{ lookup('container_volumes', service_name) | indent(4) }} {{ lookup('container_healthcheck', service_name) | indent(4) }} {{ lookup('container_depends_on', application_id) | indent(4) }}