mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
e3d2a24bcd
The interim CVE-2026-109618 mitigation lived in the shared hardening.ini, so every PHP role ran without a memory limit until the last image was patched, and no role's service_memory_mb share applied. Registry metadata of the images pinned on main shows that 16 of the 20 consumers already ship PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or the Alpine/Debian build of it). Four predate the fix: markoshust/magento-php:8.4-fpm (8.4.21), ghcr.io/heviat/webmail:2024.06 (the Mailu OIDC flavor, built 2025-04-04), phpldapadmin/phpldapadmin:2.3.11 (built 2026-05-15) and ghcr.io/shopware/docker-base:8.3 (8.3.25). - Move memory_limit = -1 into its own content-addressed ini (FILE_PHP_MEMORY_UNLIMITED_INI) and mount it only in magento, mailu, phpldapadmin and shopware. - hardening.ini keeps expose_php, session.upload_progress.enabled and fatal_error_backtraces as permanent hardening. - Joomla's php-upload.ini loads as conf.d/uploads.ini again: no -1 has to be outranked anymore. - The root TODO names the four images that still need the override. Refs #1126 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
2.6 KiB
YAML
51 lines
2.6 KiB
YAML
---
|
|
# Path Variables for Key Directories and Scripts
|
|
DIR_HOME_ADMINISTRATOR: "/home/administrator/"
|
|
DIR_SCRIPTS_ROOT: "/opt/scripts/"
|
|
DIR_SCRIPTS_SYSTEMCTL: "{{ [ DIR_SCRIPTS_ROOT, 'systemctl' ] | path_join }}"
|
|
DIR_COMPOSITIONS: "/opt/compose/"
|
|
DIR_SYSTEM_SERVICE: "/etc/systemd/system"
|
|
DIR_SYSTEM_SERVICE_USER: "$HOME/.config/systemd/user"
|
|
DIR_COMPOSE_PULL_LOCK: "/run/ansible/compose-pull/"
|
|
|
|
DIR_BIN: "/usr/bin"
|
|
BIN_COMPOSE: "{{ [ DIR_BIN, 'compose' ] | path_join }}"
|
|
BIN_CONTAINER: "{{ [ DIR_BIN, 'container' ] | path_join }}"
|
|
BIN_LOCK: "{{ [ DIR_BIN, 'lock' ] | path_join }}"
|
|
BIN_CA_TRUST: "{{ [ DIR_BIN, 'ca-trust-wrapper' ] | path_join }}"
|
|
BIN_CA_INJECT: "{{ [ DIR_BIN, 'ca-inject' ] | path_join }}"
|
|
BIN_CA_PHP_INI: "{{ [ DIR_BIN, 'ca-trust-php.ini' ] | path_join }}"
|
|
BIN_RESOLVE_CONTAINER_ID: "{{ [ DIR_BIN, 'resolve-container-id' ] | path_join }}"
|
|
|
|
DIR_VAR_LIB: "/var/lib/infinito"
|
|
DIR_BACKUPS: "{{ [DIR_VAR_LIB, 'backup'] | path_join }}"
|
|
BACKUP_REPOSITORIES:
|
|
- backup-docker-to-local
|
|
- backup-nfs-to-local
|
|
- backup-secrets-to-local
|
|
DIR_SECRETS: "{{ [DIR_VAR_LIB, 'secrets'] | path_join }}"
|
|
FILE_TOKENS: "{{ [DIR_SECRETS, 'tokens.yml'] | path_join }}"
|
|
FILE_DATABASE_SECRETS: "{{ [DIR_SECRETS, 'databases.csv'] | path_join }}"
|
|
|
|
DIR_METRICS_TEXTFILE: "{{ [DIR_VAR_LIB, 'metrics'] | path_join }}"
|
|
|
|
DIR_PHP_HARDENING: "/etc/{{ SOFTWARE_DOMAIN }}/php"
|
|
PHP_HARDENING_INI_DIGEST: "{{ (lookup('file', lookup('path_absolute', 'roles/sys-svc-compose-php/files/hardening.ini')) | hash('sha1'))[:8] }}"
|
|
PHP_MEMORY_UNLIMITED_INI_DIGEST: "{{ (lookup('file', lookup('path_absolute', 'roles/sys-svc-compose-php/files/memory-unlimited.ini')) | hash('sha1'))[:8] }}"
|
|
PHP_FPM_HARDENING_CONF_DIGEST: "{{ (lookup('template', lookup('path_absolute', 'roles/sys-svc-compose-php/templates/fpm-hardening.conf.j2')) | hash('sha1'))[:8] }}"
|
|
FILE_PHP_HARDENING_INI: "{{ [DIR_PHP_HARDENING, 'hardening-' ~ PHP_HARDENING_INI_DIGEST ~ '.ini'] | path_join }}"
|
|
FILE_PHP_MEMORY_UNLIMITED_INI: "{{ [DIR_PHP_HARDENING, 'memory-unlimited-' ~ PHP_MEMORY_UNLIMITED_INI_DIGEST ~ '.ini'] | path_join }}"
|
|
FILE_PHP_FPM_HARDENING_CONF: "{{ [DIR_PHP_HARDENING, 'fpm-hardening-' ~ PHP_FPM_HARDENING_CONF_DIGEST ~ '.conf'] | path_join }}"
|
|
|
|
DIR_RESCUE_DIAGNOSTICS: "/tmp/infinito-rescue-diagnostics"
|
|
FILE_DNS53_SAMPLER_LOG: "/var/log/infinito/dns53-sampler.log"
|
|
|
|
FILE_ENVIRONMENT: "/etc/environment" # File to safe environment variables in
|
|
|
|
CA_BUNDLE_CANDIDATES: # Where the distributions keep the extracted CA bundle, most likely first
|
|
- "/etc/ssl/certs/ca-certificates.crt"
|
|
- "/etc/pki/tls/certs/ca-bundle.crt"
|
|
- "/etc/ssl/ca-bundle.pem"
|
|
- "/etc/pki/tls/cacert.pem"
|
|
- "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
|