187 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jknapp	1c9b0edeca	Merge pull request 'Remove mod_http2/mod_md from Apache images + build gate (CVE-2026-119618)' (#39) from fix/disable-http2-md-modules into trunk	2026-11-12 14:01:06 +00:00
shadowdaoandClaude Sonnet 5.5	541c565947	Remove mod_http2/mod_md from Apache images, add build gate (CVE-2026-119618) ... mod_http2 (httpd 2.4.55-2.4.70) assign_headers() heap corruption -> RCE; AlmaLinux has no fixed httpd yet. Nothing in WHP uses HTTP/2 inside a container (HAProxy edge terminates h2/h3 and speaks HTTP/1.1 to backends), so uninstall mod_http2 (and mod_md if ever present) from cac, cac-fpm and shared-httpd. scripts/httpd-h2-md-gate.sh fails the build if http2_module, proxy_http2_module or md_module is loadable or `httpd -t` fails, writes /etc/whp-httpd-version and the images get LABEL org.whp.httpd-h2-md=removed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb	2026-11-12 05:58:57 -08:00
jknapp	adf74e2f69	Merge pull request #38: index-safe php.net emergency guard and emergency workflow [skip ci]	2026-11-12 01:55:43 +00:00
shadowdaoandClaude Sonnet 5.5	8a6a6d7b44	ci: multi-arch-safe php.net guard and emergency workflow (no platform change) ... - scripts/image-label-amd64.sh: index-safe read of the amd64 image's labels (OCI index with attestations, Docker manifest list, single manifest). - scripts/php-emergency-guard.sh: used by both build-push.yaml guard sites; same decisions as the old inline step on single-platform images, but FAILS CLOSED when the labels cannot be read (only "tag not found" passes). - lsphp-source-emergency.yaml: push by digest + assemble (copy of HMB assemble-multiarch-index.sh); optional arm64; refuses to replace a multi-arch production tag with amd64-only unless allow_amd64_only. - Tests wired into Shell-Checks; main build matrix platforms unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb	2026-11-11 17:22:24 -08:00
jknapp	4b35869477	Merge pull request #37: arch-aware mariadb repo and lsphp lookups [skip ci]	2026-11-12 01:15:07 +00:00
shadowdaoandClaude Sonnet 5.5	ad66667053	build: arch-aware mariadb.repo and lsphp index lookup (amd64 unchanged) ... - Dockerfile, Dockerfile.fpm: select rhel$releasever-<amd64|aarch64> from uname -m (amd64 file is byte-identical; $basearch cannot be used, x86_64 path 404s). - scripts/lsphp-repo-version.sh replaces three inline binary-amd64 lookups (build-push.yaml x2, lsphp-source-emergency.yaml); arch defaults to amd64. - fixture test wired into Shell-Checks. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb	2026-11-11 17:01:34 -08:00
jknapp	e7d4db5bd3	Merge pull request 'fix(cac): healthcheck fails only on no answer or 5xx, not 4xx' (#34) from fix/healthcheck-4xx into trunk	2026-10-22 15:04:10 +00:00
jknapp	0fee1b54c4	Merge pull request 'pkg-cache: Debian/NodeSource/Go/EL9 modes; wire cac-litespeed + cac-lsphp; docs' (#36) from ci/pkg-cache-more-upstreams into trunk	2026-10-22 14:35:51 +00:00
shadowdaoandClaude Opus 5.5	9baa7a6029	docs(pkg-cache): new upstreams, modes, wired repos, how to add an upstream ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 07:35:36 -07:00
shadowdaoandClaude Opus 5.5	3a6cab19ee	ci: wire cac-litespeed and cac-lsphp to the package cache and digest-pinned base ... Dockerfile.litespeed / Dockerfile.lsphp: one global ARG BASE_IMAGE=litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER} used by every stage (incl. the emergency lsphp-src stage, which stays on upstream repos). The stages that run lsphp-apt-upgrade.sh (litespeed final, lsphp ext-build + final) take ARG PKG_CACHE=, ship pkg-cache-repos.sh + keys/pkg-cache/, and wrap the upgrade in `pkg-cache-repos.sh apt` ... `pkg-cache-repos.sh restore`. Without PKG_CACHE both are no-ops. lsphp-apt-upgrade.sh: the madison gate also accepts ${PKG_CACHE}/litespeed/ as the lsphp source, but only when PKG_CACHE is set. build-push.yaml: Build-LiteSpeed-Images and Build-LSPHP-Images resolve the base digest directly from Docker Hub, probe the cache, set up buildx with the registry mirror only for a pinned base, and pass BASE_IMAGE + PKG_CACHE. OLS_VERSION (1.8.4) is now a job-level env read by both the digest lookup and the build-arg. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 07:11:52 -07:00
shadowdaoandClaude Opus 5.5	6a11fc9894	feat(pkg-cache): Debian, NodeSource, Go proxy and EL9 support in pkg-cache-repos.sh ... Backward compatible; existing modes unchanged for existing callers. - apt: also rewrites deb.debian.org/debian, deb.debian.org/debian-security and security.debian.org to <cache>/debian and <cache>/debian-security; the listing no longer fails under pipefail when /etc/apt/sources.list is absent (Debian 13 images). - rpm: rewrites rpm.nodesource.com repos to <cache>/nodesource (gpgcheck=1; NodeSource does not sign repomd). - new `nodesource MAJOR`: writes the nodesource-nodejs repo itself with the committed signing key (replaces curl setup_N.x | bash). - new `go-env`: prints GOPROXY=<cache>/goproxy|https://proxy.golang.org|direct plus SSL_CERT_FILE for the RUN; go.sum + sum.golang.org still verify. - release-install: EL9 or EL10 picked from rpm %rhel; adds RPM-GPG-KEY-EPEL-9. - PKG_CACHE is regex-validated. Tested through the cache on a throwaway runner CT (pve vmbr2): EL9+EPEL9, NodeSource 22 on EL10, Debian trixie apt, golang:1.25 apt + go-env; restore left no cache reference in each case. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 07:08:22 -07:00
jknapp	05ad47a833	Merge pull request 'ci: pin base images by digest resolved directly from Docker Hub' (#35) from ci/base-image-digest-pin into trunk	2026-10-22 13:59:04 +00:00
shadowdaoandClaude Opus 5.5	d1547f3418	ci: pin base images by digest resolved directly from Docker Hub ... With the pkg-cache BuildKit mirror on, `FROM almalinux/10-base` was resolved by tag through the cache, so a compromised cache could substitute the image. Each job using the mirror now looks up the base tag's digest DIRECTLY at registry-1.docker.io (.gitea/scripts/resolve-base-image.sh, HTTPS, HEAD on the manifest, regex-validated) and builds FROM image@sha256:... via the BASE_IMAGE build-arg, so the mirror can only serve content-addressed blobs. If the lookup fails, the mirror is NOT used for that job and the tag is pulled straight from Docker Hub. The digest is resolved every run (no manual bumps); local builds default to the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 06:58:16 -07:00
shadowdaoandClaude Opus 5.5	a00a3c7fc3	fix(cac): healthcheck fails only on no answer or 5xx, not 4xx ... curl -f also failed on 403/404, so a new site with an empty docroot showed unhealthy forever and WHP's monitor restarted it as PHP wedged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 05:41:40 -07:00
jknapp	3334f94cd5	Merge pull request 'ci: stop building PHP 7.4, 8.0 and 8.1 images' (#33) from ci/drop-eol-php into trunk	2026-10-22 01:13:20 +00:00
shadowdaoandClaude Opus 5.5	76fc53358c	ci: stop building PHP 7.4, 8.0 and 8.1 images ... All four image matrices (cac, cac-fpm, cac-litespeed, cac-lsphp) and the emergency lsphp-from-source workflow now build PHP 8.2-8.5 only. 7.4-8.1 are end of life and got no upstream fix for CVE-2026-109618/109619; no fleet site runs them any more. Existing :php74/:php80/:php81 tags stay in the registry but are no longer rebuilt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 18:13:18 -07:00
jknapp	fc60ac5ef3	Merge pull request 'fix(pkg-cache): no | while read pipelines under pipefail (Shell-Checks)' (#32) from fix/pkg-cache-shellcheck-pipefail into trunk	2026-10-21 23:48:21 +00:00
shadowdaoandClaude Opus 5.5	472fdcbc4d	fix(pkg-cache): no | while read pipelines under pipefail ... Shell-Checks' structural scan (scripts/tests/lsphp-info-probe.test.sh) flagged two `cmd | while read` loops in pkg-cache-repos.sh restore. Read the lists with mapfile from a process substitution instead, so there is no pipeline. The test now passes locally (36/0), shellcheck is clean, and the restore tests (new cache-referencing file removed, leftover reference -> FATAL) behave as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 16:48:17 -07:00
jknapp	cb0cecb557	Merge pull request 'feat(build): opt-in PKG_CACHE build arg for the internal package cache (HTTPS, GPG-verified)' (#31) from feat/pkg-cache-build-arg into trunk	2026-10-21 23:46:39 +00:00
shadowdaoandClaude Opus 5.5	2b9e7f302c	ci: enable PKG_CACHE via a TLS probe that falls back to upstream; host repo tool ... - build-push.yaml: Build-and-Push, Build-FPM-Images, Build-Shared-httpd and Build-Shared-OLS probe https://192.168.1.40 and :5000 with the pinned pkg-cache CA (5 s timeouts). When the cache answers they pass PKG_CACHE and configure the BuildKit Docker Hub mirror (ca=). When it doesn't, they build from upstream exactly as before and emit a warning. Fallback measured from the runner bridge: refused <1 s, silent drop 10 s. - scripts/host/pkgcache-host-repos.sh: apply/revert/status for WHP hosts. Each rewritten repo uses baseurl=<cache> <origin> as the real fallback; mirrorlist/metalink stay commented because measured dnf ignores baseurl when they are present. Keeps gpgcheck=1 / repo_gpgcheck=1 and backs up every file. Tested on 192.168.1.148, including cache-down and silent-drop fallback. - docs: runner firewall rule (applied), measured fallback results. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 16:46:03 -07:00
shadowdaoandClaude Opus 5.5	18f65c6d84	fix(pkg-cache): HTTPS-only cache, GPG-verified release RPMs, strict restore ... Security review follow-up for the opt-in PKG_CACHE path: - PKG_CACHE must be https:// (http is refused). The cache's certificate comes from a name-constrained internal CA (keys/pkg-cache/ca.crt, valid only for 192.168.1.40 / pkg-cache.*). The CA is trusted only by the rewritten repos (dnf sslcacert bundle, apt per-host CaInfo) and only for the duration of the RUN. - epel-release / remi-release are no longer installed straight from a URL. release-install downloads them over HTTPS, checks the package name, imports the signing keys committed in keys/pkg-cache/ and requires `rpm -K` "signatures OK", then installs with localpkg_gpgcheck=1. This applies with and without the cache. - Rewritten repos get gpgcheck=1. Remi and AlmaLinux also get repo_gpgcheck=1, since both sign repomd.xml. EPEL does not publish a repomd signature, so it relies on end-to-end HTTPS. - restore also deletes files it created and any new repo/apt file that still references the cache, then fails the build if a reference remains under /etc/yum.repos.d, /etc/dnf or /etc/apt. - docs: trust model, replay risk, proposed openssl/httpd/ImageMagick minimum-version gates, TLS registry mirror (BuildKit ca= / dockerd certs.d, no insecure-registries). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 12:53:24 -07:00
shadowdaoandClaude Opus 5.5	b2bec5b3ee	feat(build): opt-in PKG_CACHE build arg for the internal package cache ... Adds scripts/pkg-cache-repos.sh and wires it into Dockerfile, Dockerfile.fpm, Dockerfile.shared-httpd and Dockerfile.shared-ols. With --build-arg PKG_CACHE=http://192.168.1.40 (CT130 pkg-cache), dnf/apt go through the LAN cache. That cache fetches from the Remi/EPEL/AlmaLinux/ Ubuntu/LiteSpeed origins over HTTPS, with fallback tiers and stale-on-error. Without the arg the script is a no-op and builds are unchanged. - rpm: each baseurl becomes "<cache>/<prefix>/... <origin>/...", so dnf fails over to the origin if the cache dies mid-build - every RUN restores the original repo files before it ends, so no shipped layer carries the LAN address - EPEL/Remi release RPMs come from the cache when it is set - the php.net version gates are untouched Dockerfile.litespeed/.lsphp are not wired yet (see docs/pkg-cache.md). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 12:29:54 -07:00
jknapp	fa7808897f	Merge pull request 'feat(lsphp): emergency lsphp build from php.net source (same support as packaged)' (#30) from feat/lsphp-source-emergency into trunk	2026-10-21 16:48:40 +00:00
shadowdaoandClaude Opus 5.5	42993f42bd	ci(security): no ${{ }} in run:, validate resolved versions, LiteSpeed index over HTTPS ... Security review of #30: step outputs derived from the LiteSpeed apt index (fetched over plain HTTP) were spliced into shell via ${{ }} in jobs that hold registry push secrets — a MITM'd "version" would be shell injection. - every run: block in build-push.yaml and lsphp-source-emergency.yaml now receives matrix values, step outputs, inputs and run_id via env: only (incl. the pre-existing php.net / LiteSpeed resolve steps from #24/#29) - resolved versions are regex-checked before GITHUB_OUTPUT: PHP ^[0-9]+\.[0-9]+\.[0-9]+$, deb ^[0-9][0-9A-Za-z.+~:-]*$ - LiteSpeed Packages index fetched over HTTPS (--proto =https); measured rpms.litespeedtech.com serves it (HTTP/2 200) - lsphp-src-build.sh / lsphp-src-overlay.sh validate PHPVER too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 09:47:44 -07:00
shadowdaoandClaude Opus 5.5	83c2ee9c2a	feat(lsphp): emergency build path compiling lsphp from php.net source ... For when a PHP security release is out and the LiteSpeed apt repo lags (2026-10-21: php2shell CVE-2026-109618/-109619 fixed in 8.2.35/8.3.36/ 8.4.27/8.5.12, LiteSpeed still on 8.2.34/8.3.35/8.4.26/8.5.11). Dockerfile.lsphp / Dockerfile.litespeed gain an `lsphp-src` stage that is idle unless PHP_SRC_VERSION is set; normal builds are unchanged (measured: module list, file manifest, ldd, ini and dpkg identical to the published images). When set (lsphp-src-build.sh): - tarball sha256 (php.net releases JSON) + OpenPGP signature against the committed php.net keyring, signer pinned per branch - configure flags replayed from the packaged lsphp's own Configure Command - LiteSpeed's php-litespeed-8.3 SAPI (what the packages actually compile, measured) instead of php-src's sapi/litespeed; sha256-pinned and checked against the packaged binary's LSAPI_* names - packaged compiled-in ini defaults reproduced (session.save_path on 8.2/ 8.3) and gated (`php -n` diff) - ABI gate (lsphp-abi-gate.sh, pahole) before reusing LiteSpeed's packaged PECL .so files; regression-tested in Shell-Checks lsphp-src-overlay.sh swaps only php-src-owned files (decided by dpkg) and fails the build unless extensions, versions, effective ini and feature lines match the packaged lsphp under both CLI and litespeed SAPIs. CI: lsphp-source-emergency.yaml (workflow_dispatch only). build-push.yaml refuses to overwrite a newer php.net image with an older packaged one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 09:46:22 -07:00
jknapp	be1540f559	Merge pull request 'fix(images): Remi origin over HTTPS first; fail builds older than php.net' (#29) from fix/remi-origin-https into trunk	2026-10-21 15:29:41 +00:00
shadowdaoandClaude Opus 5.5	af7fd193e5	fix(images): Remi origin over HTTPS first; fail builds older than php.net ... Security review of #28: plain-http repo metadata could be replayed to keep a build on old (validly signed) vulnerable PHP. The origin is now tried over HTTPS first, with http only as a fallback (its HTTPS timed out/reset under the 2026-10-21 release load). CI resolves php.net's current release per branch (over HTTPS) and the build fails if the installed PHP is older, so neither a lagging mirror nor replayed metadata can ship a vulnerable PHP. Tested on 192.168.1.193 (almalinux/10-base): rewritten baseurl installs PHP 8.5.12; the gate passes at 8.5.12 and fails at 8.5.99. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 08:29:31 -07:00
jknapp	e8e3bfd490	Merge pull request 'fix(images): install Remi packages from the origin, not the lagging mirrors' (#28) from fix/remi-origin into trunk	2026-10-21 15:02:41 +00:00
shadowdaoandClaude Opus 5.5	c49f456336	fix(images): install Remi packages from the origin, not the lagging mirrors ... During the php2shell release the Remi mirrors still served 8.2.34 hours after 8.2.35 was published, so cac/cac-fpm builds shipped vulnerable PHP. Enable the repo files' baseurl (rpms.remirepo.net) and comment the mirrorlist. Verified on the build server: a clean almalinux/10-base install now gets PHP 8.2.35. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 08:02:38 -07:00
jknapp	bcd737a9e2	Merge pull request 'ci: fail-fast false on every image matrix' (#27) from fix/ci-no-fail-fast into trunk	2026-10-21 14:55:53 +00:00
shadowdaoandClaude Opus 5.5	955aec4573	ci: fail-fast false on every image matrix ... One failing PHP version (runs 4645/4646: cac-fpm php80, cac php82) cancelled every other cac/cac-fpm build, so no PHP security build of 8.3-8.5 was pushed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 07:55:49 -07:00
jknapp	998eb17f39	Merge pull request 'fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed' (#26) from fix/php2shell-ini-mitigation into trunk	2026-10-21 14:22:07 +00:00
shadowdaoandClaude Opus 5.5	f461d22aae	fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed ... CVE-2026-109618 / CVE-2026-109619 (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). Adds configs/zz-php2shell-mitigation.ini (fatal_error_backtraces=0, session.upload_progress.enabled=0, max_input_nesting_level=16) and installs it into each image's PHP scan dir as zz-php2shell-mitigation.ini so it sorts after 99-prod-overrides.ini and the entrypoint-written 99-* fragments: - Dockerfile / Dockerfile.fpm: COPY to /etc/php.d/ next to prod-php.ini. - Dockerfile.lsphp / Dockerfile.litespeed: COPY to /etc/lsws-templates/ and cp into the computed lsphp $SCAN_DIR in the existing overrides RUN. fatal_error_backtraces is unknown to (and silently ignored by) PHP < 8.5, so one file serves every version. Remove once all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 07:21:47 -07:00
jknapp	cfde82ae44	Merge pull request 'fix(lsphp-apt-upgrade): no early-exit readers under pipefail' (#25) from fix/lsphp-upgrade-pipefail into trunk	2026-10-21 14:07:07 +00:00
shadowdaoandClaude Opus 5.5	132e591503	fix(lsphp-apt-upgrade): no early-exit readers under pipefail ... apt-cache madison | grep -q and apt-cache policy | awk '...exit' can SIGPIPE the writer under pipefail and report lsphp missing when it is there. Read each output into a variable and match in the shell. Fixes the Shell-Checks failure on trunk (lsphp-info-probe.test.sh structural scan). Tested: lsphp-info-probe.test.sh 36/36, shellcheck clean, and the script run in litespeedtech/openlitespeed:1.8.4-lsphp85 upgrades 8.5.0 -> 8.5.11 OK. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 07:07:05 -07:00
jknapp	642b97707d	Merge pull request 'feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version' (#24) from feat/lsphp-upgrade-at-build into trunk	2026-10-21 13:08:15 +00:00
shadowdaoandClaude Opus 5.5	71ca114529	feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version ... cac-litespeed and cac-lsphp start FROM litespeedtech/openlitespeed:1.8.4-lsphpNN, which ships lsphp85 8.5.0 / lsphp84 8.4.15 (built 2025-12). lsphp only moved forward as a side effect of installing lsphpNN-ldap. lsphp-apt-upgrade.sh now sweeps every installed lsphpNN* package (and OS packages) to the repo's current release on every build and fails the build if the repo is unreachable or the result doesn't match what CI resolved from the repo index. CI passes a per-run CACHE_BUST so the upgrade layer is never a cache hit, and images carry org.whp.php-version / org.whp.lsphp-package-version labels. Tested on .148 (2026-10-21): cac-lsphp php85/php84 and cac-litespeed php85 built from this branch report the same PHP (8.5.11 / 8.4.26), identical module lists and OLS 1.8.4 as the current registry images; with the hardening flags each serves/runs PHP as the customer uid, restarts, and stops cleanly (exit 0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 06:07:48 -07:00
jknapp	74e12407f8	Merge pull request 'fix(entrypoint): no recursive chmod, graceful stop, fpm error_log owner, symlink-safe root paths, dotfile deny' (#23) from fix/no-recursive-chmod-on-start into trunk	2026-10-21 00:01:29 +00:00
shadowdaoandClaude Opus 5.5	74648ba34b	fix(security): deny config/VCS dotfiles over HTTP on standalone cac and cac-litespeed ... Measured on .148: standalone cac served /.env with its contents, and cac-litespeed served /.env even at mode 0640 (OLS runs as the customer uid there). shared-httpd and shared-ols already deny these via WHP's drop-ins; the standalone tiers never got them. - cac: new configs/whp-security.conf in /etc/httpd/conf.d — the same named FilesMatch + DirectoryMatch list as WHP's shared-httpd-security.conf, re-rooted to /home. - cac-litespeed: the same `context exp:` regex as WHP's shared-ols vhconf template, added to the vhost template. Named list (.user.ini .env* .git .svn .hg .bzr .ht* .whp .site-builder), not a blanket dotfile deny, so /.well-known/ stays reachable. HTTP only: PHP still reads these files from disk. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 16:31:56 -07:00
shadowdaoandClaude Opus 5.5	86a88c87db	fix(safe-paths): unlink planted symlinks as the customer, then fail closed ... Root rm -f in drop_symlink could be redirected by a parent-directory swap to delete arbitrary files as root. drop_symlink and the logs/ symlink sweep now unlink AS THE CUSTOMER (can never delete anything the customer couldn't), and drop_symlink still refuses to start if the path is a symlink afterwards; the pre-daemon logs/ gate re-checks and fails closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 16:06:41 -07:00
shadowdaoandClaude Opus 5.5	02d93f4d1a	fix(safe-paths): fail closed on planted symlinks before root daemons start ... drop_symlink unlinks as root (rm on the final component never follows the target and the customer cannot deny it) and refuses to start if the path is still a symlink. user_touch refuses unless it ends up a regular file. New require_safe_logs runs immediately before httpd / php-fpm start (they open files under /home/$user/logs as root): logs/, logs/apache, logs/php-fpm must be real directories and nothing under logs/ may be other than a regular file or directory, else the entrypoint exits 1 without starting any daemon. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 16:04:21 -07:00
shadowdaoandClaude Opus 5.5	94a73ea8ab	fix(safe-paths): unlink symlinks and create files as the customer, never as root ... drop_symlink and the logs/ symlink sweep now unlink AS THE CUSTOMER, and user_touch no longer falls back to a root chown -h (a parent dir swapped for a symlink between check and use could still redirect a root path operation). A root-owned leftover error_log is fixed by the existing chown -R, which never follows symlinks. Every operation these helpers perform is now safe even if the customer races it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 15:52:01 -07:00
shadowdaoandClaude Opus 5.5	0ffccac4b8	fix(entrypoint): root never follows customer symlinks under /home/$user ... /home/$user is the customer's bind mount; they can plant symlinks in it. The entrypoints ran as root and wrote/chowned through customer paths, so e.g. logs/php-fpm/error.log -> /etc/shadow (or a dangling crontab -> /etc/...) handed the customer that file, i.e. container root. New scripts/safe-paths.sh, used by entrypoint.sh and entrypoint-fpm.sh: - secure_home: refuse to start if /home/$user is not a real dir; logs/ must be a real dir and every symlink under logs/ is removed and logged (apache and php-fpm open those files as root at start). - dirs, the pool error_log and the default crontab are created AS THE CUSTOMER (setpriv, runuser fallback); a pre-existing root-owned error_log is fixed with chown -h (never dereferences). - the user crontab is read as the customer and piped to `crontab -u $user -` (root reading it could install any root-readable file where the customer can `crontab -l` it). DEV-mode crontab/mysql_creds are written via as_user tee. - the o+x directory pass (find -type d, no -L) runs as the customer, so a dir swapped for a symlink before chmod can only reach what the customer owns. - chown -R is unchanged: GNU default -P lchown()s symlinks, never follows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 15:49:18 -07:00
shadowdaoandClaude Opus 5.5	eaf616eb30	fix(entrypoint): graceful docker stop + cac-fpm error_log owner on first start ... Graceful stop (cac, cac-fpm, shared-httpd, and form-sender which runs cac): entrypoint.sh, entrypoint-fpm.sh and entrypoint-shared-httpd.sh end with bash as PID 1 tailing logs. PID 1 only receives signals it has a handler for, so docker stop's SIGTERM was dropped; docker waited the full 10s and SIGKILLed apache / php-fpm mid-request (exit 137). The entrypoints now trap TERM/INT and stop each daemon they started via the new scripts/stop-services.sh: httpd graceful-stop (WINCH), php-fpm QUIT, crond TERM, each with a bounded wait and a TERM/KILL fallback, budgets summing to < 10s, then exit 0. The log tail is backgrounded + `wait`ed (and shared-httpd's 60s rescan sleep likewise) so the trap runs immediately. Log streaming to docker logs is unchanged. cac-fpm error_log: entrypoint-fpm.sh `touch`ed logs/php-fpm/error.log as root AFTER its chown -R, so on a site's first start the pool (customer uid) could not open it and PHP errors went out as FastCGI stderr to shared-httpd's log until the next restart. The file is now created and chowned to the customer right after the logs dir is made, before php-fpm starts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 15:44:14 -07:00
shadowdaoandClaude Opus 5.5	14761597bb	fix(entrypoint): stop chmod -R 755 on the customer docroot every start ... entrypoint.sh and entrypoint-fpm.sh ran `chmod -R 755 /home/$user` on every container start. /home/$user is the bind-mounted customer site directory, so every file (wp-config.php included) became world-readable and executable, and any tighter permissions the customer set were reverted on each restart. The line dates from the initial commit (95b9397) and was copied into the FPM entrypoint (c781678); neither gives a reason. The legitimate need is that Apache (bundled httpd, or shared-httpd reading /mnt/users/...) runs as `apache`, not the customer, and must be able to traverse directories to serve static files. Keep the recursive chown. Replace the recursive chmod with: - chmod 755 on the docroot directory itself (matches entrypoint-litespeed.sh) - o+x on directories that lack it (find -type d ! -perm -o=x) Regular files are never touched: execute is never added, and wp-config.php or any other customer-restricted file is never loosened. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 12:33:29 -07:00
jknapp	db19ee24c3	ci: add workflow_dispatch trigger for manual rebuilds	2026-09-28 03:15:17 +00:00
shadowdaoandClaude Sonnet 5	3841b18820	fix(shared-ols): enableCache 0 so headerless responses are never cached ... LSCWP's Divi compat disables the plugin for ?et_fb= / ?et_pb_preview= / ?preview=true, so those responses carry no X-LiteSpeed-Cache-Control header. With module-level enableCache 1, OLS cached them anyway (Divi Visual Builder pages served from cache; the plugin's own QS exclusion never runs). enableCache 0 caches only responses that opt in via an explicit X-LiteSpeed-Cache-Control: public header. Measured on OLS 1.8.4: headerless = miss,hit under 1 / not cached under 0; explicit public cached under both. Matches the dedicated cac-litespeed tier. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-21 06:55:02 -07:00
shadowdaoandClaude Opus 5	48b714447f	chore: pin the shared-memory project key ... Ties every collaborator's Claude Code to the same shared-memory project automatically, instead of each machine inferring a key from the directory name. Read by project.identify at session start. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-23 08:09:04 -07:00
shadowdao	ba9650ee45	Merge branch 'fix/ols-watcher-scope'	2026-08-13 21:39:37 -07:00
shadowdao	77af001af6	fix(ols): pin procps explicitly for pgrep dependency ... entrypoint-shared-ols.sh's ols_running() liveness check now shells out to pgrep, but procps was never in Dockerfile.shared-ols's apt-get install list — pgrep works today only because Ubuntu 24.04's base image pulls procps in transitively. If that stops being true, pgrep: command not found -> exit 127 -> ols_running() false forever -> the crash-loop breaker (MAX_STARTS/WINDOW) escalates to a hard exit 1 at boot. Make the dependency explicit so it can't be pruned as unused.	2026-08-13 21:39:14 -07:00