4 Commits

Include renames

Author	SHA1	Message	Date
shadowdaoandClaude Opus 5.5	f461d22aae	fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed ... CVE-2026-109618 / CVE-2026-109619 (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). Adds configs/zz-php2shell-mitigation.ini (fatal_error_backtraces=0, session.upload_progress.enabled=0, max_input_nesting_level=16) and installs it into each image's PHP scan dir as zz-php2shell-mitigation.ini so it sorts after 99-prod-overrides.ini and the entrypoint-written 99-* fragments: - Dockerfile / Dockerfile.fpm: COPY to /etc/php.d/ next to prod-php.ini. - Dockerfile.lsphp / Dockerfile.litespeed: COPY to /etc/lsws-templates/ and cp into the computed lsphp $SCAN_DIR in the existing overrides RUN. fatal_error_backtraces is unknown to (and silently ignored by) PHP < 8.5, so one file serves every version. Remove once all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 07:21:47 -07:00
shadowdaoandClaude Opus 5.5	71ca114529	feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version ... cac-litespeed and cac-lsphp start FROM litespeedtech/openlitespeed:1.8.4-lsphpNN, which ships lsphp85 8.5.0 / lsphp84 8.4.15 (built 2025-12). lsphp only moved forward as a side effect of installing lsphpNN-ldap. lsphp-apt-upgrade.sh now sweeps every installed lsphpNN* package (and OS packages) to the repo's current release on every build and fails the build if the repo is unreachable or the result doesn't match what CI resolved from the repo index. CI passes a per-run CACHE_BUST so the upgrade layer is never a cache hit, and images carry org.whp.php-version / org.whp.lsphp-package-version labels. Tested on .148 (2026-10-21): cac-lsphp php85/php84 and cac-litespeed php85 built from this branch report the same PHP (8.5.11 / 8.4.26), identical module lists and OLS 1.8.4 as the current registry images; with the hardening flags each serves/runs PHP as the customer uid, restarts, and stops cleanly (exit 0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 06:07:48 -07:00
shadowdaoandClaude Opus 4.7	80fa06592b	perf(litespeed): defer mariadb-server + memcached install to DEV runtime ... Drops these from the build-time apt install in Dockerfile.litespeed; they now install at entrypoint time only when environment=DEV, guarded by 'command -v mysqld' so container restarts skip the apt step. Mirrors the cac:phpNN pattern. The mysql CLI client is already in the litespeedtech/openlitespeed base, so wp-cli + DEV creds-bootstrap still work without a build-time client install. Measured (php83 / OLS 1.8.4): PROD image: 1.64 GB -> 1.20 GB (~440 MB savings) PROD first-200 boot: unchanged at ~1.5s DEV first boot: ~51s (apt install cost — one-time per container) DEV second boot: ~6s (cache hit, same as PROD) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-02 08:26:19 -07:00
shadowdaoandClaude Opus 4.7	55c28a0c11	Add cac-litespeed image family (OpenLiteSpeed, native LSAPI) ... New paid-tier per-customer image built on litespeedtech/openlitespeed:1.8.4-lsphpNN. Matrix: 8.1-8.5. Native LSAPI suexec to customer uid, server-level LSCache, all WP/WooCommerce extensions (memcached, redis, imagick, mbstring, etc.) baked in. Files: - Dockerfile.litespeed (FROM prebuilt LiteSpeed base, layers wp-cli/composer/mariadb) - configs/litespeed/{httpd_config,site-template,lsphp-overrides}.tpl - scripts/{entrypoint,create-vhost,detect-memory}-litespeed.sh + install-lscache-wp.sh CI: new Build-LiteSpeed-Images matrix job. OLS_VERSION pinned to 1.8.4 (only release with prebuilt images for all 5 PHP versions on Docker Hub). Spec: whp/docs/superpowers/specs/2026-06-01-cac-litespeed-design.md Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-02 07:32:47 -07:00