0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

History

kevinveenbirkenbachandClaude Opus 5.5 a2e91a6158 fix(sys-ctl-hlth-runtime): run the check after every app container exists

hlth-runtime set system_service_force_flush_final: false. In debug mode
(CI) that makes sys-service start the unit as soon as the role is
included, so whether the check saw the app containers depended on where
the role landed in the play: in CI run 41023277637 SuiteCRM#0 and
Nextcloud#4 had their containers up first (suitecrm started 11:46:28,
check 11:49:02), while FusionDirectory#0 in the run before checked
before its containers existed and passed without inspecting anything.
In production (SYS_SERVICE_ALL_ENABLED false) the unit never ran during
a deploy at all, only from its timer.

Put it on the final run list like every other health check that
inspects containers (hlth-container, hlth-volumes, hlth-csp,
hlth-webserver, hlth-disc-space, hlth-btrfs): sys-service-terminator
starts it once all apps are deployed, so a runtime below its floor
fails the deploy deterministically.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-30 18:47:50 +01:00

files/python

fix(sys-ctl-hlth-runtime): bound the engine calls and catch hidden PHP runtimes

2026-10-29 15:32:57 +01:00

lookup_plugins

…

README.md

Container Runtime Health Check

Description

This role checks the language runtime inside every running Docker container. It reads the PHP version of each container that ships a php binary and the effective PHP hardening of each service that mounts the shared hardening ini from sys-svc-compose-php.

Overview

The role installs a check script with a systemd service and timer. The check fails, and the failure notifier from sys-ctl-alm-compose alerts, when a container runs PHP below the security floor of its release line or on an end-of-life line, or when a service that declares php_hardening in its meta/volumes.yml still reports expose_php or session.upload_progress.enabled as on. The floors, the lowest patched release of each major.minor line, live in HEALTH_RUNTIME_FLOORS in main.yml.

Cosmos

The diagram places Container Runtime Health Check in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-ctl-hlth-runtime 💻]
        svc_runtime["runtime"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

Runtime floor: Fails for every running container whose PHP is below the floor of its major.minor line, or on a line older than every listed floor (end of life). A line newer than every floor passes.
Hardening verification: Runs php inside every service that mounts php_hardening and fails while expose_php or session.upload_progress.enabled is on, which catches a wrong scan dir, a later ini that overrides the hardening, and an image change.
Sidecar report: Lists other PHP containers of a hardened stack, such as cron or worker sidecars, as info without failing.
Registry report: make security-runtimes lists the PHP runtime of every pinned image from registry metadata, without pulling, against the same floors.

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).