mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
d89c74feab
Proxy: - server_tokens off, X-Powered-By stripped from upstream responses, HSTS max-age raised to one year. - No global X-Content-Type-Options: under nosniff, ORB (step 3.4) blocks no-cors cross-origin responses typed text/html, e.g. tracking beacons answered with an empty 204. PHP (CVE-2026-109618, CVE-2026-109619): - New role sys-svc-compose-php installs a shared ini (expose_php Off, session.upload_progress.enabled 0, fatal_error_backtraces 0 for PHP 8.5, interim memory_limit -1) and a PHP-FPM [www] drop-in (pm.max_requests = PHP_FPM_MAX_REQUESTS) once per stack host, before 04_files renders any compose file. - The host file names carry a sha1 prefix of the controller-side source, so a content change alters every PHP app's compose.yml and recreates it, also on remote deploys where compose_volumes cannot read the stack host file and hashes the path instead. - 20 PHP roles mount the ini as a compose/swarm config into their image's scan dir; moodle, nextcloud and shopware also mount the FPM drop-in. Magento keeps its own pool: its php-fpm.conf has no include= and is rendered without notify. - Joomla's php-upload.ini now loads as zzz-joomla-uploads.ini so its own memory_limit wins: the media API compares Content-Length with toBytes(memory_limit) and rejects every upload at -1. TODOs record the memory_limit revert condition and accepted trade-offs, Akaunting on PHP 8.1, FusionDirectory on PHP 7.4 and the public Keycloak admin console. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
69 lines
1.9 KiB
YAML
69 lines
1.9 KiB
YAML
---
|
|
data:
|
|
type: volume
|
|
name: stalwart_data
|
|
mounts:
|
|
- service: stalwart
|
|
target: /var/lib/stalwart
|
|
config:
|
|
type: volume
|
|
name: stalwart_config
|
|
mounts:
|
|
- service: stalwart
|
|
target: /etc/stalwart
|
|
webmail_data:
|
|
type: volume
|
|
name: stalwart_webmail_data
|
|
mounts:
|
|
- service: webmail
|
|
target: /var/www/html
|
|
clamav_data:
|
|
type: volume
|
|
name: stalwart_clamav_data
|
|
mounts:
|
|
- service: clamav
|
|
target: /var/lib/clamav
|
|
config_file:
|
|
type: config
|
|
source: "{{ [ lookup('container', 'web-app-stalwart', 'directories.volumes'), 'etc/config.json' ] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: stalwart
|
|
target: /etc/stalwart/config.json
|
|
# nocheck: meta-volume-file-bind-should-be-config — multi-MB zip exceeds the docker config size limit; the role is manager-pinned so the bind source is always node-local
|
|
webui_bundle:
|
|
type: bind
|
|
source: "{{ [ lookup('container', 'web-app-stalwart', 'directories.volumes'), 'etc/webui.zip' ] | path_join }}"
|
|
read_only: true
|
|
mounts:
|
|
- service: stalwart
|
|
target: /etc/stalwart/webui.zip
|
|
certs:
|
|
type: bind
|
|
source: "{{ [ lookup('container', 'web-app-stalwart', 'directories.volumes'), 'certs' ] | path_join }}"
|
|
read_only: true
|
|
mounts:
|
|
- service: stalwart
|
|
target: /etc/stalwart/certs
|
|
clamav_milter_conf:
|
|
type: config
|
|
source: "{{ [ lookup('container', 'web-app-stalwart', 'directories.volumes'), 'etc/clamav-milter.conf' ] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: clamav
|
|
target: /etc/clamav/clamav-milter.conf
|
|
webmail_oauth:
|
|
type: config
|
|
source: "{{ [ lookup('container', 'web-app-stalwart', 'directories.volumes'), 'webmail/oauth.inc.php' ] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: webmail
|
|
target: /var/roundcube/config/oauth.inc.php
|
|
php_hardening:
|
|
type: config
|
|
source: "{{ FILE_PHP_HARDENING_INI }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: webmail
|
|
target: /usr/local/etc/php/conf.d/zz-infinito-hardening.ini
|