mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
3c743736a8
Answering "which deployed containers run a vulnerable PHP?" after CVE-2026-109618/109619 took a manual inventory of registry metadata, and nothing noticed a hardening ini that an image never loads. - New role sys-ctl-hlth-runtime, routed through sys-svc-compose next to sys-ctl-hlth-container. A daily timer runs `php` in every running container and fails, alerting through sys-ctl-alm-compose, when PHP is below the floor of its line or on a line older than every floor (7.4, 8.1). Every service that mounts php_hardening in meta/volumes.yml fails while expose_php or session.upload_progress.enabled is on; other PHP containers of such a stack are listed as info. Compose and swarm containers are matched by their project/stack and service labels. The check is not run at deploy time, so a finding never fails a deploy. - The floors (8.2.35, 8.3.36, 8.4.27, 8.5.12) live once, in HEALTH_RUNTIME_FLOORS of the role's vars/main.yml. - `make security-runtimes` lists the PHP of every pinned role image without pulling: Docker Hub tags through the Hub API, which no pull rate limit meters, other registries through the OCI config blob (new registry.config_blob, which the healthcheck probe now reuses). PHP_VERSION, distro PHP packages and a PHP_BASE build argument count. It exits 1 on an image below its floor or one the registry did not answer. Today it flags nfrastack/fusiondirectory:1.5 (line 7.4) and shopware/docker-base:8.3 (8.3.25). The role TODO.md keeps the follow-ups: further runtimes, the split web SAPI of web-app-lam, a scheduled CI run of the report and the CVE scan. Refs #1127 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
---
|
|
- include_tasks: 00_core.yml
|
|
when: run_once_sys_svc_compose is not defined
|
|
|
|
- name: "🧭 Route docker cleanup/health deps through service-loader"
|
|
ansible.builtin.include_role:
|
|
name: sys-service-loader
|
|
tasks_from: list_or_shoot.yml
|
|
vars:
|
|
list_or_shoot_roles:
|
|
- sys-ctl-cln-docker
|
|
- sys-ctl-hlth-container
|
|
- sys-ctl-hlth-runtime
|
|
- sys-ctl-hlth-volumes
|
|
- sys-ctl-rpr-container-hard
|
|
|
|
- name: "🧭 Route svc-bkp-volume-2-local through service-loader (when deployed)"
|
|
ansible.builtin.include_role:
|
|
name: sys-service-loader
|
|
tasks_from: list_or_shoot.yml
|
|
vars:
|
|
list_or_shoot_roles:
|
|
- svc-bkp-volume-2-local
|
|
when: "'svc-bkp-volume-2-local' in group_names"
|
|
|
|
- name: "🖥️ Stack-host-only prep (dirs, repo, files, CA trust) for '{{ application_id }}'"
|
|
include_tasks: "02_stack_host_prep.yml"
|
|
when: IS_STACK_HOST | bool
|
|
|
|
- name: "📁 Pre-create NFS subdirs for '{{ application_id }}' (swarm + NFS only)"
|
|
include_tasks: "utils/nfs_prep.yml"
|
|
|
|
- name: "✅ Ensure instance dir for '{{ application_id }}' is up"
|
|
include_tasks: "utils/up.yml"
|
|
when: IS_STACK_HOST | bool
|