mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
e3d2a24bcd
The interim CVE-2026-109618 mitigation lived in the shared hardening.ini, so every PHP role ran without a memory limit until the last image was patched, and no role's service_memory_mb share applied. Registry metadata of the images pinned on main shows that 16 of the 20 consumers already ship PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or the Alpine/Debian build of it). Four predate the fix: markoshust/magento-php:8.4-fpm (8.4.21), ghcr.io/heviat/webmail:2024.06 (the Mailu OIDC flavor, built 2025-04-04), phpldapadmin/phpldapadmin:2.3.11 (built 2026-05-15) and ghcr.io/shopware/docker-base:8.3 (8.3.25). - Move memory_limit = -1 into its own content-addressed ini (FILE_PHP_MEMORY_UNLIMITED_INI) and mount it only in magento, mailu, phpldapadmin and shopware. - hardening.ini keeps expose_php, session.upload_progress.enabled and fatal_error_backtraces as permanent hardening. - Joomla's php-upload.ini loads as conf.d/uploads.ini again: no -1 has to be outranked anymore. - The root TODO names the four images that still need the override. Refs #1126 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
149 lines
4.3 KiB
YAML
149 lines
4.3 KiB
YAML
---
|
|
data:
|
|
type: volume
|
|
name: shopware_data
|
|
|
|
bundles:
|
|
type: volume
|
|
name: shopware_bundles
|
|
mounts:
|
|
- service: init
|
|
target: &var_www_html_public_bundles_target /var/www/html/public/bundles
|
|
- service: web
|
|
target: *var_www_html_public_bundles_target
|
|
- service: worker
|
|
target: *var_www_html_public_bundles_target
|
|
- service: scheduler
|
|
target: *var_www_html_public_bundles_target
|
|
|
|
files:
|
|
type: volume
|
|
name: shopware_files
|
|
mounts:
|
|
- service: init
|
|
target: &var_www_html_files_target /var/www/html/files
|
|
- service: web
|
|
target: *var_www_html_files_target
|
|
- service: worker
|
|
target: *var_www_html_files_target
|
|
- service: scheduler
|
|
target: *var_www_html_files_target
|
|
|
|
media:
|
|
type: volume
|
|
name: shopware_media
|
|
mounts:
|
|
- service: init
|
|
target: &var_www_html_public_media_target /var/www/html/public/media
|
|
- service: web
|
|
target: *var_www_html_public_media_target
|
|
- service: worker
|
|
target: *var_www_html_public_media_target
|
|
- service: scheduler
|
|
target: *var_www_html_public_media_target
|
|
|
|
sitemap:
|
|
type: volume
|
|
name: shopware_sitemap
|
|
mounts:
|
|
- service: init
|
|
target: &var_www_html_public_sitemap_target /var/www/html/public/sitemap
|
|
- service: web
|
|
target: *var_www_html_public_sitemap_target
|
|
- service: worker
|
|
target: *var_www_html_public_sitemap_target
|
|
- service: scheduler
|
|
target: *var_www_html_public_sitemap_target
|
|
|
|
theme:
|
|
type: volume
|
|
name: shopware_theme
|
|
mounts:
|
|
- service: init
|
|
target: &var_www_html_public_theme_target /var/www/html/public/theme
|
|
- service: web
|
|
target: *var_www_html_public_theme_target
|
|
- service: worker
|
|
target: *var_www_html_public_theme_target
|
|
- service: scheduler
|
|
target: *var_www_html_public_theme_target
|
|
|
|
thumbnail:
|
|
type: volume
|
|
name: shopware_thumbnail
|
|
mounts:
|
|
- service: init
|
|
target: &var_www_html_public_thumbnail_target /var/www/html/public/thumbnail
|
|
- service: web
|
|
target: *var_www_html_public_thumbnail_target
|
|
- service: worker
|
|
target: *var_www_html_public_thumbnail_target
|
|
- service: scheduler
|
|
target: *var_www_html_public_thumbnail_target
|
|
|
|
init_script:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-shopware', 'directories.volumes'), 'init.sh'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: init
|
|
target: &usr_local_bin_init_sh_target /usr/local/bin/init.sh
|
|
- service: web
|
|
target: *usr_local_bin_init_sh_target
|
|
- service: worker
|
|
target: *usr_local_bin_init_sh_target
|
|
- service: scheduler
|
|
target: *usr_local_bin_init_sh_target
|
|
|
|
framework_yaml:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-shopware', 'directories.config'), 'framework.yaml'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: init
|
|
target: &var_www_html_config_packages_framework_yaml_target /var/www/html/config/packages/framework.yaml
|
|
- service: web
|
|
target: *var_www_html_config_packages_framework_yaml_target
|
|
- service: worker
|
|
target: *var_www_html_config_packages_framework_yaml_target
|
|
- service: scheduler
|
|
target: *var_www_html_config_packages_framework_yaml_target
|
|
|
|
adminopenauth_yaml:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-shopware', 'directories.config'), 'adminopenauth.yaml'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: init
|
|
target: &var_www_html_config_packages_adminopenauth_yaml_target /var/www/html/config/packages/adminopenauth.yaml
|
|
- service: web
|
|
target: *var_www_html_config_packages_adminopenauth_yaml_target
|
|
- service: worker
|
|
target: *var_www_html_config_packages_adminopenauth_yaml_target
|
|
- service: scheduler
|
|
target: *var_www_html_config_packages_adminopenauth_yaml_target
|
|
|
|
php_hardening:
|
|
type: config
|
|
source: "{{ FILE_PHP_HARDENING_INI }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: web
|
|
target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini
|
|
|
|
php_memory_unlimited:
|
|
type: config
|
|
source: "{{ FILE_PHP_MEMORY_UNLIMITED_INI }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: web
|
|
target: /usr/local/etc/php/conf.d/zz-infinito-memory-unlimited.ini
|
|
|
|
php_fpm_hardening:
|
|
type: config
|
|
source: "{{ FILE_PHP_FPM_HARDENING_CONF }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: web
|
|
target: /usr/local/etc/php-fpm.d/zz-infinito-hardening.conf
|