mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
46fe011796
#1259 moved the interim CVE-2026-109618 mitigation (memory_limit = -1) out of the shared hardening.ini into memory-unlimited.ini and mounted it only in the roles whose images it had inventoried. Its branch predates #1263, which gave FusionDirectory the php_hardening mount, so after both merged FusionDirectory ran with the image default of 128M again. A conf.d mount would not have fixed it: the nfrastack image writes php_admin_value[memory_limit] into its FPM pool (/etc/php7/pools.d/www/www-settings.conf) from PHP_MEMORY_LIMIT, and a pool php_admin_value outranks every conf.d ini. Measured on main: CLI 128M, FPM 128M. So even before #1259 the hardening ini only ever lifted the CLI limit. nfrastack/fusiondirectory:1.5 runs PHP 7.4.33 on Alpine 3.15, end of life and never patched, so the role carries the mitigation until it moves to a PHP 8 image. - Set PHP_MEMORY_LIMIT=-1 in templates/env.j2. The image seds it into php.ini and the pool, so CLI and FPM both report -1. - The root TODO lists FusionDirectory with the image and the reason it uses the variable instead of the mount; the role TODO names which setting carries which CVE mitigation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
12 lines
609 B
Django/Jinja
12 lines
609 B
Django/Jinja
{% include 'roles/sys-svc-container/templates/env.j2' %}
|
|
|
|
FUSIONDIRECTORY_ADMIN_USER={{ lookup('users', 'administrator').username }}
|
|
FUSIONDIRECTORY_ADMIN_PASS={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
LDAP01_NAME={{ application_id | get_entity_name }}
|
|
LDAP01_HOST={{ lookup('config', 'svc-db-openldap', 'services.openldap.name') }}
|
|
LDAP01_PORT={{ lookup('config', 'svc-db-openldap', 'services.openldap.ports.local.ldap') }}
|
|
LDAP01_ADMIN_DN={{ LDAP.DN.ADMINISTRATOR.DATA }}
|
|
LDAP01_ADMIN_PASS={{ LDAP.BIND_CREDENTIAL | dotenv_quote }}
|
|
LDAP01_BASE_DN={{ LDAP.DN.ROOT }}
|
|
PHP_MEMORY_LIMIT=-1
|