mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5.5
7f745604cb
FusionDirectory was the one PHP role #1115 left without the shared hardening ini, so its PHP 7.4 kept session.upload_progress enabled and a finite memory_limit, the two settings behind CVE-2026-109619 and CVE-2026-109618. The nfrastack image runs Alpine's php7 with /etc/php7/conf.d as scan dir. Its init only links module inis there and chmods/chowns the tree; php-ext reset, which empties conf.d, runs at build time only. A read-only config at conf.d/zz-infinito-hardening.ini therefore survives the init and loads after 99-*.ini, so it wins. The PHP line itself stays on 7.4: FusionDirectory certifies 1.4 to 1.6 for PHP 7.4 only, nfrastack/container-fusiondirectory builds only on PHP 7.4 and Alpine 3.15, and the PHP 8 port is upstream's unreleased php8 branch. TODO.md records that state and the options. The php_hardening entry sits above data in meta/volumes.yml and the TODO note replaces only the mounted item, so the pending feature/store-i18n changes to both files still merge cleanly. Refs #1120 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 lines
411 B
YAML
16 lines
411 B
YAML
---
|
|
php_hardening:
|
|
type: config
|
|
source: "{{ FILE_PHP_HARDENING_INI }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: fusiondirectory
|
|
target: /etc/php7/conf.d/zz-infinito-hardening.ini
|
|
# nocheck: embedded-state-on-nfs generated asset cache; the authoritative state lives in LDAP
|
|
data:
|
|
type: volume
|
|
name: fusiondirectory_data
|
|
mounts:
|
|
- service: fusiondirectory
|
|
target: /assets/fusiondirectory
|