12 Commits

Include renames

Author	SHA1	Message	Date
shadowdaoandClaude Opus 5.5	18f65c6d84	fix(pkg-cache): HTTPS-only cache, GPG-verified release RPMs, strict restore ... Security review follow-up for the opt-in PKG_CACHE path: - PKG_CACHE must be https:// (http is refused). The cache's certificate comes from a name-constrained internal CA (keys/pkg-cache/ca.crt, valid only for 192.168.1.40 / pkg-cache.*). The CA is trusted only by the rewritten repos (dnf sslcacert bundle, apt per-host CaInfo) and only for the duration of the RUN. - epel-release / remi-release are no longer installed straight from a URL. release-install downloads them over HTTPS, checks the package name, imports the signing keys committed in keys/pkg-cache/ and requires `rpm -K` "signatures OK", then installs with localpkg_gpgcheck=1. This applies with and without the cache. - Rewritten repos get gpgcheck=1. Remi and AlmaLinux also get repo_gpgcheck=1, since both sign repomd.xml. EPEL does not publish a repomd signature, so it relies on end-to-end HTTPS. - restore also deletes files it created and any new repo/apt file that still references the cache, then fails the build if a reference remains under /etc/yum.repos.d, /etc/dnf or /etc/apt. - docs: trust model, replay risk, proposed openssl/httpd/ImageMagick minimum-version gates, TLS registry mirror (BuildKit ca= / dockerd certs.d, no insecure-registries). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 12:53:24 -07:00
shadowdaoandClaude Opus 5.5	b2bec5b3ee	feat(build): opt-in PKG_CACHE build arg for the internal package cache ... Adds scripts/pkg-cache-repos.sh and wires it into Dockerfile, Dockerfile.fpm, Dockerfile.shared-httpd and Dockerfile.shared-ols. With --build-arg PKG_CACHE=http://192.168.1.40 (CT130 pkg-cache), dnf/apt go through the LAN cache. That cache fetches from the Remi/EPEL/AlmaLinux/ Ubuntu/LiteSpeed origins over HTTPS, with fallback tiers and stale-on-error. Without the arg the script is a no-op and builds are unchanged. - rpm: each baseurl becomes "<cache>/<prefix>/... <origin>/...", so dnf fails over to the origin if the cache dies mid-build - every RUN restores the original repo files before it ends, so no shipped layer carries the LAN address - EPEL/Remi release RPMs come from the cache when it is set - the php.net version gates are untouched Dockerfile.litespeed/.lsphp are not wired yet (see docs/pkg-cache.md). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 12:29:54 -07:00
shadowdaoandClaude Opus 5.5	af7fd193e5	fix(images): Remi origin over HTTPS first; fail builds older than php.net ... Security review of #28: plain-http repo metadata could be replayed to keep a build on old (validly signed) vulnerable PHP. The origin is now tried over HTTPS first, with http only as a fallback (its HTTPS timed out/reset under the 2026-10-21 release load). CI resolves php.net's current release per branch (over HTTPS) and the build fails if the installed PHP is older, so neither a lagging mirror nor replayed metadata can ship a vulnerable PHP. Tested on 192.168.1.193 (almalinux/10-base): rewritten baseurl installs PHP 8.5.12; the gate passes at 8.5.12 and fails at 8.5.99. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 08:29:31 -07:00
shadowdaoandClaude Opus 5.5	c49f456336	fix(images): install Remi packages from the origin, not the lagging mirrors ... During the php2shell release the Remi mirrors still served 8.2.34 hours after 8.2.35 was published, so cac/cac-fpm builds shipped vulnerable PHP. Enable the repo files' baseurl (rpms.remirepo.net) and comment the mirrorlist. Verified on the build server: a clean almalinux/10-base install now gets PHP 8.2.35. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 08:02:38 -07:00
shadowdaoandClaude Opus 5.5	f461d22aae	fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed ... CVE-2026-109618 / CVE-2026-109619 (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). Adds configs/zz-php2shell-mitigation.ini (fatal_error_backtraces=0, session.upload_progress.enabled=0, max_input_nesting_level=16) and installs it into each image's PHP scan dir as zz-php2shell-mitigation.ini so it sorts after 99-prod-overrides.ini and the entrypoint-written 99-* fragments: - Dockerfile / Dockerfile.fpm: COPY to /etc/php.d/ next to prod-php.ini. - Dockerfile.lsphp / Dockerfile.litespeed: COPY to /etc/lsws-templates/ and cp into the computed lsphp $SCAN_DIR in the existing overrides RUN. fatal_error_backtraces is unknown to (and silently ignored by) PHP < 8.5, so one file serves every version. Remove once all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 07:21:47 -07:00
shadowdaoandClaude Opus 5.5	71ca114529	feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version ... cac-litespeed and cac-lsphp start FROM litespeedtech/openlitespeed:1.8.4-lsphpNN, which ships lsphp85 8.5.0 / lsphp84 8.4.15 (built 2025-12). lsphp only moved forward as a side effect of installing lsphpNN-ldap. lsphp-apt-upgrade.sh now sweeps every installed lsphpNN* package (and OS packages) to the repo's current release on every build and fails the build if the repo is unreachable or the result doesn't match what CI resolved from the repo index. CI passes a per-run CACHE_BUST so the upgrade layer is never a cache hit, and images carry org.whp.php-version / org.whp.lsphp-package-version labels. Tested on .148 (2026-10-21): cac-lsphp php85/php84 and cac-litespeed php85 built from this branch report the same PHP (8.5.11 / 8.4.26), identical module lists and OLS 1.8.4 as the current registry images; with the hardening flags each serves/runs PHP as the customer uid, restarts, and stops cleanly (exit 0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 06:07:48 -07:00
shadowdaoandClaude Opus 4.6	c65f533dcc	Add HEIC/HEIF/AVIF support + fix MariaDB repo for AlmaLinux 10 ... Added ImageMagick-heic package to both Dockerfile and Dockerfile.fpm. This is a separate EPEL subpackage that provides HEIC, HEIF, and AVIF format support via libheif. Without it, ImageMagick is installed but cannot process iPhone photos and modern image formats. Also fixed MariaDB repo URL: AlmaLinux 10 uses $releasever=10 but MariaDB mirrors don't have an 'almalinux10' directory. Changed to 'rhel10' which is the supported path for EL10 derivatives. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-01 15:48:58 -07:00
shadowdaoandClaude Opus 4.6	7f7cb456f0	Add openssl to package installs for AlmaLinux 10 ... AlmaLinux 10 base image does not include openssl by default (AL9 did). Add it explicitly to all three Dockerfiles since it's needed for self-signed cert generation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-01 11:11:10 -07:00
shadowdaoandClaude Opus 4.6	dc6ce2bf12	Upgrade base image from AlmaLinux 9 to AlmaLinux 10 ... Bump all three Dockerfiles to almalinux/10-base with matching EPEL 10 and Remi 10 repository URLs. AlmaLinux 10.1 has been stable since Nov 2025. All PHP versions (7.4-8.5) confirmed available via Remi for EL10. Also removes --allowerasing from shared-httpd Dockerfile since AL10 base does not ship curl-minimal. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-01 10:55:26 -07:00
shadowdaoandClaude Opus 4.6	367da7806c	Fix ImageMagick install: use EPEL packages instead of upstream RPMs ... The official ImageMagick 7.1.2-18 RPMs require GLIBC 2.38 which is not available on AlmaLinux 9 (ships GLIBC 2.34). Switch to EPEL-provided ImageMagick packages which are built for EL9 and guaranteed compatible. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-01 10:44:03 -07:00
shadowdaoandClaude Opus 4.6	a5cb45a386	Install latest ImageMagick 7.1.2-18 from official RPMs ... Adds ImageMagick and ImageMagick-libs from the official CentOS x86_64 RPMs before PHP installation so php-pecl-imagick links against the latest version. Applied to both Dockerfile (standalone) and Dockerfile.fpm (shared httpd mode). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-01 10:15:15 -07:00
shadowdaoandClaude Opus 4.6	c78167871c	Add shared httpd + PHP-FPM-only container architecture ... Separate Apache and PHP-FPM into distinct container roles to reduce per-customer memory overhead on shared servers. Adds three new images: - Dockerfile.fpm: PHP-FPM only (no Apache), listens on TCP port 9000 - Dockerfile.shared-httpd: Apache only (no PHP), with SSL and proxy_fcgi - Existing Dockerfile unchanged for standalone mode Key changes: - detect-memory.sh: CONTAINER_ROLE env var (combined/fpm_only/httpd_only) controls the memory budget split - create-php-config.sh: FPM_LISTEN env var for TCP port vs Unix socket, added /fpm-ping and /fpm-status health endpoints - New entrypoints for each container role - tune-mpm.sh for hot-adjusting Apache MPM settings - shared-vhost-template.tpl with proxy_fcgi and SSL on port 443 - CI/CD builds all three image types in parallel Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-01 10:08:00 -07:00