fix(shared-ols): unmapped Host gets 421, not a 200 that hides a dead site

The shared-OLS catch-all (`map _health *`) served html/index.html --
HTTP 200, 11 bytes, "shared-ols" -- to any Host no customer vhost claimed.
Three live customer sites (joshuaknapp.net, streamers.channel,
blog.anti-social.online) sat in exactly that state for ~2 months on whp01
and no monitor noticed, because every uptime check asks "is it 200?" and
it was. A tier-wide catch-all that answers 200 makes a missing vhost
indistinguishable from a working site.

An unmapped Host now gets 421 Misdirected Request with a short generic
body. 421 is semantically exact (the server cannot produce a response for
the requested authority) and, unlike 404, cannot be confused with a normal
answer from a real site.

The discriminator is the request path plus the client address, NOT the
Host -- the vhost is selected by the listener map, so by the time these
rules run the Host is no longer available to branch on:

  * `/healthz` from an internal client address (loopback, RFC1918) -> 200 "ok"
  * everything else, every path, every Host, both listeners -> 421

The 421 for `/` is UNCONDITIONAL: no header, source address or Host talks
this vhost into a 200 there, so the property the change exists to
guarantee does not rest on anything spoofable. The address gate only
hardens /healthz, and X-Forwarded-For cannot be used against it because
HAProxy replaces that header with the real client IP.

Health probes keep passing unchanged. Both forms were run against a
container carrying this change and both exit 0 with "ok":
  curl -fsSk https://127.0.0.1/healthz   (Dockerfile.shared-ols HEALTHCHECK)
  curl -sfk  https://localhost/healthz   (WHP setup-shared-ols.sh --health-cmd)
`docker inspect` reported healthy with failingStreak=0, on a container with
a customer site and on a zero-site container.

Measured on the lab VM against OLS 1.8.4 (the production base image):
  unmapped Host, `/`, :443 and :80   -> 421, 356 bytes, identical for every
                                        unmapped Host (no enumeration signal)
  unmapped Host, any deeper path     -> the same 421
  configured site, both names, :443/:80 -> 200, served normally
  litespeed -t                        -> 0 [ERROR] lines (warnings only, and
                                        only about the lab fixture's uid/gid)

Two OLS behaviours were measured rather than assumed, and both shaped the
implementation -- see the comment block in entrypoint-shared-ols.sh:
`context / { type redirect statusCode 421 }` silently degrades to a 302
with an unexpanded Location, and the `errorpage 421` body is fetched as a
fresh request through the same rewrite rules (so it needs a %{THE_REQUEST}
guard, since %{IS_SUBREQ} and %{ENV:REDIRECT_STATUS} are not populated).

The old index.html is removed, not just bypassed: if these rules ever
stopped applying, `context /` would fall back to the docRoot index, and
with no index.html that is a 403 -- wrong-but-loud, rather than a 200 that
is wrong-and-silent.

Known consumer to land alongside this: whp-monitoring's
probe_shared_ols_catchall() currently detects the catch-all by matching
`200` + body `shared-ols`, a signature this change deletes. It must also
accept 421, or the detector silently stops detecting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-push.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - trunk
-  workflow_dispatch:
 
 jobs:
   # Shell gate. Runs FIRST and costs seconds; the images below do not depend on

.shared-memory-project

@@ -1 +0,0 @@
-cloud-hosting-platform/cloud-apache-container

Dockerfile

@@ -40,7 +40,6 @@ COPY ./configs/phpinfo.php /var/www/html/
 COPY ./configs/mariadb.repo /etc/yum.repos.d/
 COPY ./configs/index.php /var/www/html/
 COPY ./configs/remote_ip.conf /etc/httpd/conf.d/
-COPY ./configs/whp-security.conf /etc/httpd/conf.d/
 
 # Set up cron job in a single layer
 RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab

Dockerfile.shared-httpd

@@ -13,7 +13,6 @@ COPY ./scripts/detect-memory.sh /scripts/detect-memory.sh
 COPY ./scripts/create-apache-mpm-config.sh /scripts/create-apache-mpm-config.sh
 COPY ./scripts/log-rotate.sh /scripts/log-rotate.sh
 COPY ./scripts/entrypoint-shared-httpd.sh /scripts/entrypoint-shared-httpd.sh
-COPY ./scripts/stop-services.sh /scripts/stop-services.sh
 COPY ./scripts/tune-mpm.sh /scripts/tune-mpm.sh
 RUN chmod +x /scripts/*
 

Dockerfile.shared-ols

@@ -55,6 +55,13 @@ EXPOSE 80 443
 
 ## Health: the entrypoint renders a catch-all _health vhost serving /healthz, so
 ## this passes from boot (zero customer sites) onward. Self-signed :443.
+##
+## MUST stay on /healthz, and must stay a LOOPBACK request. That vhost answers
+## 421 for every other path/Host so an unmapped customer hostname can never look
+## "up" to a monitor; /healthz answers 200 only for an internal client address
+## (loopback here). Probing `/` instead would fail the healthcheck and restart
+## the whole shared tier. WHP's setup-shared-ols.sh overrides this with the
+## equivalent `curl -sfk https://localhost/healthz`; keep the two in step.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
   CMD curl -fsSk https://127.0.0.1/healthz || exit 1
 

configs/litespeed/site-template.tpl

@@ -72,18 +72,6 @@ virtualHostConfig  {
     addDefaultCharset     off
   }
 
-  ## SECURITY: never serve config / VCS dotfiles over HTTP. Same named list as
-  ## WHP's shared-ols vhconf template (first `context exp:` there) and
-  ## shared-httpd's 000-whp-security.conf. Measured on .148: this tier served
-  ## /.env even at mode 0640, because OLS runs as the customer uid here. An
-  ## `exp:` regex context wins over the `context /` prefix context regardless
-  ## of order (measured on OLS 1.8.4 for shared-ols), so a customer .htaccess
-  ## cannot reopen it. Named, not blanket "^\.": /.well-known/ (ACME,
-  ## security.txt, app-site-association) must stay reachable.
-  context exp:^/(.*/)?\.(user\.ini|env|git|svn|hg|bzr|ht|whp|site-builder) {
-    allowBrowse           0
-  }
-
   rewrite  {
     enable                1
     autoLoadHtaccess      1

configs/shared-ols/httpd_config_base.tpl

@@ -23,22 +23,10 @@ useIpInProxyHeader        1
 
 ## LSCache enabled at MODULE scope for the whole tier (dedicated cache volume,
 ## ephemeral across rebuilds; OLS auto-keys a per-vhost subdir under storagePath).
-## PUBLIC (anonymous) caching ONLY: checkPublicCache 1 lets OLS serve cacheable,
-## non-logged-in responses that are EXPLICITLY marked by the LiteSpeed Cache WP
+## PUBLIC (anonymous) caching ONLY: enableCache 1 + checkPublicCache 1 let OLS
+## serve cacheable, non-logged-in responses marked by the LiteSpeed Cache WP
 ## plugin's X-LiteSpeed-Cache-Control headers (ignoreRespCacheCtrl=0 honors them).
 ##
-## enableCache is 0 ON PURPOSE. At module scope enableCache 1 means "cache every
-## cacheable-looking public response by default", INCLUDING ones that carry no
-## cache header at all. That bit us on Divi: LSCWP's Divi compat calls
-## litespeed_disable_all for ?et_fb= / ?et_pb_preview= / ?p=N&preview=true, which
-## switches the plugin off for the request, so it sends NO header (and its own
-## "Do Not Cache Query Strings" never runs) — and OLS stored the Visual Builder
-## page under enableCache 1. With enableCache 0 only responses that opt in via
-## X-LiteSpeed-Cache-Control: public are stored; a plugin-disabled request is
-## simply not cached. Measured on OLS 1.8.4 (2026-09-21): headerless response =
-## miss,hit under 1; not cached under 0; explicit `public` header cached under
-## both. Matches the dedicated cac-litespeed tier (configs/litespeed/site-template.tpl).
-##
 ## PRIVATE caching is intentionally OFF (enablePrivateCache 0 + checkPrivateCache 0).
 ## Logged-in / cookie-bearing pages must NEVER be cached at the tier. We previously
 ## left enablePrivateCache=1 assuming "no plugin -> nothing cached," but that was
@@ -57,7 +45,7 @@ module cache {
   respCookieCache         1
   ignoreReqCacheCtrl      0
   ignoreRespCacheCtrl     0
-  enableCache             0
+  enableCache             1
   enablePrivateCache      0
 }
 ## ---- end shared-ols server append ----

configs/whp-security.conf

@@ -1,29 +0,0 @@
-## SECURITY: never serve config / VCS dotfiles over HTTP (standalone cac).
-##
-## Same named list as WHP's shared-httpd drop-in (web-files/configs/
-## shared-httpd-security.conf, 000-whp-security.conf on every shared-httpd host),
-## re-rooted from /mnt/users to /home because here the docroot is
-## /home/<user>/public_html. Standalone cac never got that drop-in, and measured
-## on .148 it served /.env with contents.
-##
-## <FilesMatch> matches the FILENAME resolved from the filesystem path, not the
-## request URL, so it cannot be side-stepped by URL-encoding. httpd applies
-## <Directory> sections (and .htaccess) first and <Files>/<FilesMatch> after
-## them, so this deny wins over create-vhost.sh's `Require all granted`.
-##
-## A NAMED LIST, NOT A BLANKET "^\." DENY: /.well-known/ (ACME, security.txt,
-## apple-app-site-association, assetlinks.json, payment-domain verification)
-## must stay reachable. FilesMatch tests the final path component, and for
-## /.well-known/acme-challenge/<token> that is <token>, not a dotfile.
-##
-## HTTP only: PHP still reads .user.ini and .env off the filesystem as before.
-<Directory "/home">
-    <FilesMatch "^\.(user\.ini|env|git|svn|hg|bzr|ht|whp|site-builder)">
-        Require all denied
-    </FilesMatch>
-</Directory>
-## Directory form: reaches the files INSIDE .git/ etc. (e.g. /.git/config,
-## whose own name is not a dotfile).
-<DirectoryMatch "^/home/.*/\.(git|svn|hg|bzr|whp|site-builder)(/|$)">
-    Require all denied
-</DirectoryMatch>

scripts/entrypoint-fpm.sh

@@ -14,18 +14,8 @@ export FPM_LISTEN=${FPM_LISTEN:-9000}
 
 adduser -u $uid $user
 
-# Root never follows customer symlinks under /home/$user: see safe-paths.sh.
-source /scripts/safe-paths.sh
-secure_home
-
-user_mkdir /home/$user/public_html /home/$user/logs/php-fpm
-# Create the pool's error_log (php_admin_value[error_log] in
-# create-php-config.sh) AS THE CUSTOMER, before php-fpm starts. It used to be
-# `touch`ed as root at the very end, after the chown -R, so on a site's first
-# start the pool (customer uid) could not open it and PHP errors fell back to
-# FastCGI stderr -> shared-httpd's error log until the next restart's chown -R
-# fixed the owner. user_touch never writes or chowns through a symlink.
-user_touch /home/$user/logs/php-fpm/error.log
+mkdir -p /home/$user/public_html
+mkdir -p /home/$user/logs/php-fpm
 
 ln -sf /home/$user/logs/php-fpm /var/log/php-fpm
 
@@ -35,27 +25,13 @@ echo "Container memory: ${CONTAINER_MEMORY_MB}MB | PHP-FPM pm=${PHP_FPM_PM} max_
 /scripts/create-php-config.sh
 
 mkdir -p /run/php-fpm/
-# php-fpm opens its slowlog under /home/$user/logs as root: last fail-closed
-# check immediately before it starts (safe-paths.sh).
-require_safe_logs /home/$user/logs/php-fpm
 /usr/sbin/php-fpm -y /etc/php-fpm.conf
-# GNU chown -R defaults to -P: symlinks are lchown()ed, never followed.
 chown -R $user:$user /home/$user
-# Do NOT `chmod -R 755` the docroot here. /home/$user is the customer's
-# bind-mounted site directory; a recursive 755 on every start made every file
-# (wp-config.php included) world-readable AND executable, and reverted any
-# tighter permissions the customer had set. Apache (shared-httpd, or the
-# bundled httpd) runs as `apache`, not the customer, so it only needs to
-# traverse directories to serve static files. Normalise that and nothing else:
-# open the docroot itself, and add o+x to directories that lack it. Regular
-# files are never touched, so execute is never added and wp-config.php is
-# never loosened. Runs as the customer (safe-paths.sh) so a symlink can only
-# reach what the customer already owns.
-open_dir_traversal
+chmod -R 755 /home/$user
 
 if [[ $environment == 'DEV' ]]; then
   echo "Starting Dev Deployment (FPM-only mode)"
-  user_mkdir /home/$user/_db_backups
+  mkdir -p /home/$user/_db_backups
   if ! command -v microdnf &> /dev/null; then
     echo "microdnf not found, installing with dnf..."
     dnf install -y microdnf && dnf clean all
@@ -73,12 +49,13 @@ if [[ $environment == 'DEV' ]]; then
     mysql -e "CREATE USER '"$mysql_user"'@'localhost' IDENTIFIED BY '"$mysql_password"';"
     mysql -e "GRANT ALL PRIVILEGES ON *.* TO '"$mysql_user"'@'localhost' WITH GRANT OPTION;"
     mysql -e "FLUSH PRIVILEGES;"
-    # Written AS THE CUSTOMER (as_user tee), never by root through a customer path.
-    drop_symlink /home/$user/crontab
-    printf '%s\n' "# User crontab for $user" "*/15 * * * * /scripts/mysql-backup.sh $user devdb_$mysql_db" \
-      | as_user tee /home/$user/crontab >/dev/null
-    printf '%s\n' "MySQL User: $mysql_user" "MySQL Password: $mysql_password" "MySQL Database: devdb_$mysql_db" \
-      | as_user tee /home/$user/mysql_creds
+    echo "# User crontab for $user" > /home/$user/crontab
+    echo "*/15 * * * * /scripts/mysql-backup.sh $user devdb_$mysql_db" >> /home/$user/crontab
+    chown $user:$user /home/$user/crontab
+    echo "MySQL User: "$mysql_user > /home/$user/mysql_creds
+    echo "MySQL Password: "$mysql_password >> /home/$user/mysql_creds
+    echo "MySQL Database: devdb_"$mysql_db >> /home/$user/mysql_creds
+    cat /home/$user/mysql_creds
   fi
   /usr/bin/memcached -d -u $user
 fi
@@ -89,32 +66,21 @@ if [[ $environment == 'PROD' ]]; then
     fi
 fi
 
-# Set up + load the user crontab, created and read as the customer
-# (safe-paths.sh). Root reading/writing/chowning it followed symlinks.
-load_user_crontab
+# Set up user crontab
+if [ ! -f /home/$user/crontab ]; then
+    echo "# User crontab for $user" > /home/$user/crontab
+    echo "# Add your cron jobs here" >> /home/$user/crontab
+    echo "# Example: */5 * * * * /home/$user/scripts/my-script.sh" >> /home/$user/crontab
+    chown $user:$user /home/$user/crontab
+fi
+
+# Load user crontab
+crontab -u $user /home/$user/crontab
 
 /usr/sbin/crond
 
-# Graceful shutdown. bash is PID 1 here, and PID 1 only receives signals it
-# has a handler for, so without this trap `docker stop`'s SIGTERM was dropped:
-# docker waited the full 10s and SIGKILLed php-fpm mid-request (exit 137).
-# php-fpm QUIT = graceful (workers finish their current request), then crond.
-source /scripts/stop-services.sh
-TAIL_PID=""
-shutdown() {
-  trap - TERM INT
-  echo "entrypoint: received stop signal, shutting down"
-  stop_service php-fpm /run/php-fpm/php-fpm.pid QUIT 6 'php-fpm: master'
-  stop_service crond /run/crond.pid TERM 1 '^/usr/sbin/crond'
-  [ -n "$TAIL_PID" ] && kill "$TAIL_PID" 2>/dev/null
-  exit 0
-}
-trap shutdown TERM INT
-
-# Tail PHP-FPM logs to docker logs. Backgrounded + `wait` (instead of a
-# foreground tail) so bash can run the trap as soon as a signal arrives.
-tail -f /home/$user/logs/php-fpm/* &
-TAIL_PID=$!
-wait "$TAIL_PID"
+# Tail PHP-FPM logs (becomes PID 1 process)
+touch /home/$user/logs/php-fpm/error.log
+tail -f /home/$user/logs/php-fpm/*
 
 exit 0

scripts/entrypoint-shared-httpd.sh

@@ -59,30 +59,11 @@ fi
 # Start cron for log rotation
 /usr/sbin/crond
 
-# Graceful shutdown. bash is PID 1 here, and PID 1 only receives signals it
-# has a handler for, so without this trap `docker stop`'s SIGTERM was dropped:
-# docker waited the full 10s and SIGKILLed apache mid-request (exit 137), for
-# every site on the host at once. graceful-stop (WINCH) lets in-flight requests
-# finish; after 7s it falls back to TERM. Timeouts sum to < 10s so this
-# completes inside docker's default stop timeout.
-source /scripts/stop-services.sh
-TAIL_PID=""
-SLEEP_PID=""
-shutdown() {
-  trap - TERM INT
-  echo "entrypoint-shared-httpd: received stop signal, shutting down"
-  stop_service httpd /etc/httpd/run/httpd.pid WINCH 7 '^/usr/sbin/httpd'
-  stop_service crond /run/crond.pid TERM 1 '^/usr/sbin/crond'
-  [ -n "$SLEEP_PID" ] && kill "$SLEEP_PID" 2>/dev/null
-  [ -n "$TAIL_PID" ] && kill "$TAIL_PID" 2>/dev/null
-  exit 0
-}
-trap shutdown TERM INT
-
-# Tail Apache logs to docker logs.
+# Tail Apache logs (becomes PID 1 process)
 # Use a loop to pick up new log files as vhosts are added.
 # tail -f only watches files that exist at start time.
 touch /var/log/httpd/error_log
+TAIL_PID=""
 while true; do
   LOG_FILES=$(find /var/log/httpd/ -name '*.log' -o -name '*_log' 2>/dev/null | sort)
   if [ -n "$TAIL_PID" ]; then
@@ -91,10 +72,6 @@ while true; do
   fi
   tail -f $LOG_FILES &
   TAIL_PID=$!
-  # Re-check for new log files every 60 seconds. Background + `wait` (not a
-  # foreground sleep) so a stop signal runs the trap immediately instead of
-  # after up to 60s.
-  sleep 60 &
-  SLEEP_PID=$!
-  wait "$SLEEP_PID"
+  # Re-check for new log files every 60 seconds
+  sleep 60
 done

scripts/entrypoint-shared-ols.sh

@@ -32,18 +32,127 @@ if [ ! -f "$CERT_FILE" ]; then
     -keyout "$KEY_FILE" -out "$CERT_FILE" -subj "/CN=shared-ols" 2>/dev/null
 fi
 
-## ---- health vhost (catch-all): valid server with zero customer sites +
-## answers HAProxy health checks that hit by IP / unknown Host with a 200 ----
+## ---- health vhost (catch-all) ----
+## This vhost is mapped `map _health *` by render-shared-ols-config.sh, so it
+## answers EVERY Host that no customer vhost claims. It exists so the server is
+## valid with zero customer sites and so local/edge health probes get a 200.
+##
+## IT MUST NOT ANSWER 200 FOR AN UNMAPPED CUSTOMER HOST.
+## It used to serve html/index.html ("shared-ols", 11 bytes) with HTTP 200 to
+## anything that fell through. Measured 2026-08: three live customer sites
+## (their vhost had silently stopped being rendered) served that 200 for ~2
+## months and no monitor noticed, because every uptime check asks "is it 200?"
+## and the answer was yes. A hostname this server cannot serve now gets
+## 421 Misdirected Request -- semantically exact (RFC 7540 s9.1.2: the server is
+## not able to produce a response for the combination of scheme and authority in
+## the request URI) and unambiguous to monitoring in a way 404 is not, since a
+## 404 is a perfectly normal answer from a real, working site.
+##
+## THE DISCRIMINATOR: request path /healthz AND an INTERNAL client address.
+##   * Path alone is not enough -- anyone can request /healthz.
+##   * REMOTE_ADDR is the half an outside caller cannot choose, BECAUSE of
+##     `useIpInProxyHeader 1` in httpd_config_base.tpl: OLS resolves the client
+##     IP from X-Forwarded-For, and HAProxy -- the only thing that can reach
+##     this tier, which has no host-published ports and sits on client-net --
+##     SETS (not appends) that header:
+##     `http-request set-header X-Forwarded-For %[var(txn.real_ip)]` in
+##     haproxy-manager-base/templates/hap_backend.tpl, which DISCARDS whatever
+##     the client sent. So a request arriving from outside carries the real
+##     public client IP. Verified on the lab: `-H 'X-Forwarded-For: 8.8.8.8'`
+##     on /healthz returns 421.
+##   * MEASURED LIMIT OF THE IP GATE, stated plainly rather than assumed away:
+##     OLS takes the FIRST element of a multi-value X-Forwarded-For as
+##     REMOTE_ADDR. `X-Forwarded-For: 10.0.0.1, 8.8.8.8` returns 200 on /healthz
+##     here, and anchoring the pattern ^...$ does NOT change that (tested both
+##     ways) -- because by the time the rule sees REMOTE_ADDR it is already the
+##     single token `10.0.0.1`. The anchors are kept because they are correct
+##     and free, not because they close that hole. What closes it is HAProxy:
+##     `http-request set-header X-Forwarded-For %[var(txn.real_ip)]` REPLACES
+##     whatever the client sent with one value.
+##   * AND THE GATE IS NOT LOAD-BEARING ANYWAY. It only guards /healthz. `/`,
+##     and every other path, is 421 UNCONDITIONALLY -- no header, source
+##     address or Host can talk this vhost into a 200 there. So even a total
+##     bypass of the IP gate buys an attacker a 3-byte `ok` on /healthz, never
+##     a "the site is up" answer on the URL a monitor actually requests. That
+##     is the property this change exists to guarantee, and it does not rest on
+##     anything spoofable.
+##   * The probes that MUST keep passing all originate inside: the Docker
+##     HEALTHCHECK (`curl -sfk https://127.0.0.1/healthz` in Dockerfile.shared-ols,
+##     overridden by WHP's setup-shared-ols.sh to `https://localhost/healthz`)
+##     connects over loopback and sends no X-Forwarded-For, so REMOTE_ADDR falls
+##     back to the peer, 127.0.0.1. An edge/host probe of the container IP comes
+##     from the docker gateway (172.16/12), also allowed.
+##
+## `/` is 421 for EVERY client, internal ones included -- there is deliberately
+## no "internal clients still get the old 200 page" escape hatch, because that
+## is exactly the response that hid the outage. Anything probing this tier for
+## liveness must ask for /healthz.
+##
+## WHY REWRITE AND NOT A REDIRECT CONTEXT: `context / { type redirect
+## statusCode 421 }` was measured on this image (OLS 1.8.4) and does NOT work --
+## 421 is not in OLS's accepted status-code list, so it silently degrades to a
+## 302 with a literal, unexpanded `Location: $DOC_ROOT/?`. A rewrite `[R=421,L]`
+## does emit a real 421.
+##
+## WHY THE THE_REQUEST GUARD ON THE ERROR PAGE: a bare [R=421] has no body, and
+## a bare 421 with no explanation is a support ticket. `errorpage 421` supplies
+## the body, but OLS fetches that URL as a fresh internal request that runs
+## through these same rules -- without an exception it is itself 421'd and the
+## body comes back empty (measured: content-length 0). %{IS_SUBREQ} and
+## %{ENV:REDIRECT_STATUS} are NOT populated by OLS's rewrite engine (both
+## measured, both no-ops), but %{THE_REQUEST} keeps the ORIGINAL request line
+## across the internal fetch. So: serve misdirected.html when the client did not
+## itself ask for it, which lets the error page render while a direct external
+## GET /misdirected.html still gets 421 -- no path on this catch-all answers 200
+## to an outside caller.
+##
+## The body is deliberately generic: no branding, no customer names, nothing
+## that reveals which hostnames this server does serve. Every unmapped Host and
+## every path gets the byte-identical 421, so the response cannot be used to
+## enumerate configured vs unconfigured hostnames.
 cat > "$HEALTH_DIR/vhconf.conf" <<'EOF'
 docRoot                   $VH_ROOT/html
 enableScript              0
+
+errorpage 421 {
+  url                     /misdirected.html
+}
+
+rewrite {
+  enable                  1
+  rules                   <<<END_rules
+  RewriteCond %{THE_REQUEST} !\s/+misdirected\.html
+  RewriteRule ^/?misdirected\.html$ - [L]
+  RewriteCond %{REMOTE_ADDR} ^(127\.0\.0\.1|::1|10\.[0-9.]+|192\.168\.[0-9.]+|172\.(1[6-9]|2[0-9]|3[01])\.[0-9.]+)$
+  RewriteRule ^/?healthz$ - [L]
+  RewriteRule .* - [R=421,L]
+  END_rules
+}
+
 context / {
   allowBrowse             1
   location                $DOC_ROOT/
 }
 EOF
 printf 'ok\n' > "$HEALTH_DIR/html/healthz"
-printf 'shared-ols\n' > "$HEALTH_DIR/html/index.html"
+cat > "$HEALTH_DIR/html/misdirected.html" <<'EOF'
+<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"><title>421 Misdirected Request</title></head>
+<body>
+<h1>421 Misdirected Request</h1>
+<p>This hostname is not configured on this server.</p>
+<p>If you own this domain, check that its DNS points to the correct server and
+that the site is active in your hosting control panel.</p>
+</body>
+</html>
+EOF
+## The old catch-all index.html ("shared-ols") is gone on purpose, and actively
+## removed so an in-place upgrade of a long-lived container cannot leave it
+## behind. If these rewrite rules were ever to stop applying, `context /` would
+## fall back to serving the docRoot index -- with no index.html that is a 403,
+## which is wrong-but-loud, instead of a 200 that is wrong-and-silent.
+rm -f "$HEALTH_DIR/html/index.html"
 
 ## ---- ownership: OLS reads conf/ as lsadm. chown the base conf dir + health dir
 ## NON-recursively (the per-site files under conf/shared-sites are written by the
@@ -51,7 +160,7 @@ printf 'shared-ols\n' > "$HEALTH_DIR/html/index.html"
 ## every container (re)start, delaying first-listen after a crash). The render
 ## script chowns the httpd_config.conf it produces. ----
 chown lsadm:nogroup "$LSWS_CONF" "$HEALTH_DIR" "$HEALTH_DIR/html" 2>/dev/null || true
-chown lsadm:nogroup "$HEALTH_DIR/vhconf.conf" "$HEALTH_DIR/html/healthz" "$HEALTH_DIR/html/index.html" 2>/dev/null || true
+chown lsadm:nogroup "$HEALTH_DIR/vhconf.conf" "$HEALTH_DIR/html/healthz" "$HEALTH_DIR/html/misdirected.html" 2>/dev/null || true
 
 ## ---- assemble httpd_config.conf from the panel's per-site files ----
 /scripts/render-shared-ols-config.sh

scripts/entrypoint.sh

@@ -10,11 +10,8 @@ fi
 
 adduser -u $uid $user
 
-# Root never follows customer symlinks under /home/$user: see safe-paths.sh.
-source /scripts/safe-paths.sh
-secure_home
-
-user_mkdir /home/$user/public_html /home/$user/logs/apache /home/$user/logs/php-fpm
+mkdir -p /home/$user/public_html
+mkdir -p /home/$user/logs/{apache,php-fpm}
 
 mv /var/log/httpd /var/log/httpd.bak
 
@@ -37,28 +34,14 @@ if [ -f /etc/httpd/conf.d/ssl.conf ]; then
   mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.bak
 fi
 
-# httpd and php-fpm open their logs under /home/$user/logs as root: last
-# fail-closed check immediately before they start (safe-paths.sh).
-require_safe_logs /home/$user/logs/apache /home/$user/logs/php-fpm
 /usr/sbin/httpd -k start
 /usr/sbin/php-fpm -y /etc/php-fpm.conf
-# GNU chown -R defaults to -P: symlinks are lchown()ed, never followed.
 chown -R $user:$user /home/$user
-# Do NOT `chmod -R 755` the docroot here. /home/$user is the customer's
-# bind-mounted site directory; a recursive 755 on every start made every file
-# (wp-config.php included) world-readable AND executable, and reverted any
-# tighter permissions the customer had set. Apache (shared-httpd, or the
-# bundled httpd) runs as `apache`, not the customer, so it only needs to
-# traverse directories to serve static files. Normalise that and nothing else:
-# open the docroot itself, and add o+x to directories that lack it. Regular
-# files are never touched, so execute is never added and wp-config.php is
-# never loosened. Runs as the customer (safe-paths.sh) so a symlink can only
-# reach what the customer already owns.
-open_dir_traversal
+chmod -R 755 /home/$user
 
 if [[ $environment == 'DEV' ]]; then
   echo "Starting Dev Deployment"
-  user_mkdir /home/$user/_db_backups
+  mkdir -p /home/$user/_db_backups
   # Ensure microdnf is available for installing MariaDB and memcached in DEV mode
   if ! command -v microdnf &> /dev/null; then
     echo "microdnf not found, installing with dnf..."
@@ -77,13 +60,14 @@ if [[ $environment == 'DEV' ]]; then
     mysql -e "CREATE USER '"$mysql_user"'@'localhost' IDENTIFIED BY '"$mysql_password"';"
     mysql -e "GRANT ALL PRIVILEGES ON *.* TO '"$mysql_user"'@'localhost' WITH GRANT OPTION;"
     mysql -e "FLUSH PRIVILEGES;"
-    # Create user crontab with MySQL backup job. Written AS THE CUSTOMER
-    # (as_user tee), never by root through a customer path.
-    drop_symlink /home/$user/crontab
-    printf '%s\n' "# User crontab for $user" "*/15 * * * * /scripts/mysql-backup.sh $user devdb_$mysql_db" \
-      | as_user tee /home/$user/crontab >/dev/null
-    printf '%s\n' "MySQL User: $mysql_user" "MySQL Password: $mysql_password" "MySQL Database: devdb_$mysql_db" \
-      | as_user tee /home/$user/mysql_creds
+    # Create user crontab with MySQL backup job
+    echo "# User crontab for $user" > /home/$user/crontab
+    echo "*/15 * * * * /scripts/mysql-backup.sh $user devdb_$mysql_db" >> /home/$user/crontab
+    chown $user:$user /home/$user/crontab
+    echo "MySQL User: "$mysql_user > /home/$user/mysql_creds
+    echo "MySQL Password: "$mysql_password >> /home/$user/mysql_creds
+    echo "MySQL Database: devdb_"$mysql_db >> /home/$user/mysql_creds
+    cat /home/$user/mysql_creds
 
   fi
   /usr/bin/memcached -d -u $user
@@ -94,37 +78,19 @@ if [[ $environment == 'PROD' ]]; then
     sed -r -i 's/;session.save_path="localhost:11211/session.save_path="memcache:11211/' /etc/php.d/50-memcached.ini
 fi
 
-# Set up + load the user crontab, created and read as the customer
-# (safe-paths.sh). Root reading/writing/chowning it followed symlinks.
-load_user_crontab
+# Set up user crontab
+if [ ! -f /home/$user/crontab ]; then
+    echo "# User crontab for $user" > /home/$user/crontab
+    echo "# Add your cron jobs here" >> /home/$user/crontab
+    echo "# Example: */5 * * * * /home/$user/scripts/my-script.sh" >> /home/$user/crontab
+    chown $user:$user /home/$user/crontab
+fi
+
+# Load user crontab
+crontab -u $user /home/$user/crontab
 
 /usr/sbin/crond
-
-# Graceful shutdown. bash is PID 1 here, and PID 1 only receives signals it
-# has a handler for, so without this trap `docker stop`'s SIGTERM was dropped:
-# docker waited the full 10s and SIGKILLed apache and php-fpm mid-request
-# (exit 137). Stop apache first (graceful-stop: finish in-flight requests,
-# accept no new ones), then php-fpm (QUIT: workers finish their current
-# request), then crond. Timeouts sum to < 10s so this completes inside
-# docker's default stop timeout.
-source /scripts/stop-services.sh
-TAIL_PID=""
-shutdown() {
-  trap - TERM INT
-  echo "entrypoint: received stop signal, shutting down"
-  stop_service httpd /etc/httpd/run/httpd.pid WINCH 4 '^/usr/sbin/httpd'
-  stop_service php-fpm /run/php-fpm/php-fpm.pid QUIT 3 'php-fpm: master'
-  stop_service crond /run/crond.pid TERM 1 '^/usr/sbin/crond'
-  [ -n "$TAIL_PID" ] && kill "$TAIL_PID" 2>/dev/null
-  exit 0
-}
-trap shutdown TERM INT
-
-# Stream apache logs to docker logs. Backgrounded + `wait` (instead of a
-# foreground tail) so bash can run the trap as soon as a signal arrives.
-tail -f /var/log/httpd/* &
-TAIL_PID=$!
-wait "$TAIL_PID"
+tail -f /var/log/httpd/*
 
 exit 0
   

scripts/render-shared-ols-config.sh

@@ -156,8 +156,25 @@ for meta in "$SITES_ROOT"/*/site.meta; do
 done
 
 ## --- 5. ALWAYS add a health vhost mapped to the catch-all so the server is
-## valid with zero customer sites and HAProxy health checks (which hit by IP /
-## unknown Host) get a 200. Exact-domain maps above win over this '*'. ---
+## valid with zero customer sites. Exact-domain maps above win over this '*'.
+##
+## THIS MAP IS WHY AN UNMAPPED HOST GETS AN ANSWER AT ALL. Anything the loop
+## above did not emit a `map` for -- a customer domain whose site dir went
+## missing, a stale DNS record, a scanner probing by IP -- lands here. It used
+## to answer 200 with an 11-byte "shared-ols" body, which is how three live
+## customer sites stayed silently broken for ~2 months: every uptime monitor
+## asks "is it 200?" and it was.
+##
+## The health vhost (its vhconf.conf is written by entrypoint-shared-ols.sh,
+## which carries the full rationale) now answers 421 Misdirected Request with a
+## short generic body for any Host it cannot serve, and keeps 200 ONLY for
+## GET /healthz from an internal client address -- the Docker HEALTHCHECK and
+## edge liveness probes. Do NOT reintroduce a 200 here for `/`: probe /healthz.
+##
+## The listener `map` itself is unchanged, deliberately. Dropping the catch-all
+## instead would make OLS answer an unmapped Host from whichever vhost it
+## considers first, which is worse: an unmapped Host would be served SOMEONE
+## ELSE'S SITE. ---
 {
   echo ""
   echo "virtualhost _health {"

scripts/safe-paths.sh

@@ -1,127 +0,0 @@
-#!/usr/bin/env bash
-# shellcheck disable=SC2154  # $uid / $user come from the container environment
-## safe-paths.sh — sourced by entrypoint.sh and entrypoint-fpm.sh. Not executed directly.
-##
-## /home/$user is the customer's bind-mounted site directory: the customer can
-## create anything in it, including symlinks, from SFTP/FTP, cron, or PHP. The
-## entrypoints run as root, and root following a customer symlink is a
-## privilege escalation: `touch`/`chown`/`>` on logs/php-fpm/error.log ->
-## /etc/shadow hands the customer /etc/shadow (container root).
-##
-## Rules the entrypoints follow:
-##   * /home/$user itself is the bind-mount point and must be a real directory.
-##   * logs/ is WHP-owned and apache / php-fpm open files in it as root, so it
-##     must be a real directory and every symlink under it is removed + logged.
-##   * Files and dirs are CREATED as the customer (as_user), so a symlink or a
-##     swapped path can only reach what the customer could reach anyway.
-##   * Ownership changes use `chown -h` / `chown -R` (GNU default -P: never
-##     follows symlinks, lchown()s them), never a dereferencing chown.
-##   * Customer files are READ as the customer (crontab), never as root.
-
-# as_user CMD... : run CMD as the customer uid/gid (no root, no caps).
-as_user() {
-  if command -v setpriv >/dev/null 2>&1; then
-    setpriv --reuid="$uid" --regid="$uid" --init-groups -- "$@"
-  else
-    runuser -u "$user" -- "$@"
-  fi
-}
-
-# die MSG : refuse to start. Only the customer who planted the path is hurt,
-# which is preferred to root following it.
-die() {
-  echo "entrypoint: FATAL: $* - refusing to start" >&2
-  exit 1
-}
-
-# drop_symlink PATH : if PATH is a symlink, unlink it AS THE CUSTOMER (rm on
-# the final component never touches the link target, and if a parent dir is
-# swapped for a symlink mid-way the customer can only delete what they already
-# could) and log it. Fails closed: still a symlink afterwards -> refuse to start.
-drop_symlink() {
-  if [ -L "$1" ]; then
-    echo "entrypoint: SECURITY: $1 was a symlink to '$(readlink "$1")' - removing" >&2
-    as_user rm -f -- "$1"
-    [ -L "$1" ] && die "could not remove symlink $1"
-  fi
-  return 0
-}
-
-# secure_home : run once, right after adduser, before anything else touches
-# /home/$user.
-secure_home() {
-  local h="/home/$user"
-  if [ -L "$h" ] || [ ! -d "$h" ]; then
-    die "$h is not a real directory (symlink or missing)"
-  fi
-  # The mount point itself: owned by the customer so as_user can create in it.
-  chown -h "$user:$user" "$h"
-  drop_symlink "$h/logs"
-  # public_html may legitimately be a symlink (release-dir deploys); it is left
-  # alone and every root-side operation on it runs as the customer instead.
-  if [ -d "$h/logs" ]; then
-    # As the customer: find without -L never follows symlinks, -delete unlinks
-    # the link itself, and a raced parent swap can only reach what the customer
-    # could already delete. Errors are not fatal HERE: require_safe_logs
-    # re-checks immediately before the daemons start and fails closed.
-    as_user find "$h/logs" -xdev -type l \
-      -printf 'entrypoint: SECURITY: %p was a symlink to %l - removed\n' -delete >&2 || true
-  fi
-}
-
-# user_mkdir DIR... : create directories as the customer.
-user_mkdir() {
-  as_user mkdir -p -- "$@"
-}
-
-# user_touch FILE : create FILE as the customer (a symlink there is dropped
-# first, fail-closed). Root never touches/chowns it: if it already exists
-# root-owned (left by an older image) the touch fails quietly and the
-# entrypoint's chown -R, which never follows symlinks, fixes the owner. Must end
-# up a regular file, or refuse to start.
-user_touch() {
-  drop_symlink "$1"
-  as_user touch -- "$1" 2>/dev/null || true
-  [ -f "$1" ] && [ ! -L "$1" ] || die "$1 is not a regular file"
-}
-
-# require_safe_logs DIR... : fail-closed gate, run immediately before starting
-# the daemons that open files under /home/$user/logs AS ROOT (httpd, php-fpm).
-# Each DIR must be a real directory, and nothing under logs/ may be anything
-# but a regular file or directory (no symlink, fifo, socket, device).
-require_safe_logs() {
-  local d bad
-  for d in "/home/$user/logs" "$@"; do
-    [ -d "$d" ] && [ ! -L "$d" ] || die "$d is not a real directory"
-  done
-  bad=$(find "/home/$user/logs" -xdev ! -type f ! -type d -print -quit 2>&1)
-  [ -z "$bad" ] || die "unsafe entry under /home/$user/logs: $bad"
-  return 0
-}
-
-# load_user_crontab : install /home/$user/crontab, read AS THE CUSTOMER. Root
-# reading it (`crontab -u $user /home/$user/crontab`) would follow a symlink to
-# any root-readable file and install it where the customer can `crontab -l` it.
-load_user_crontab() {
-  local f="/home/$user/crontab"
-  if [ ! -e "$f" ] && [ ! -L "$f" ]; then
-    as_user sh -c 'printf "%s\n" "# User crontab for $1" "# Add your cron jobs here" "# Example: */5 * * * * /home/$1/scripts/my-script.sh" > "$2"' sh "$user" "$f"
-  fi
-  # No temp file: root writing a predictable /tmp path is the same bug class.
-  local content
-  if content=$(as_user cat -- "$f" 2>/dev/null); then
-    printf '%s\n' "$content" | crontab -u "$user" -
-  else
-    echo "entrypoint: WARNING: $f not readable as $user - user crontab not loaded" >&2
-  fi
-}
-
-# open_dir_traversal : chmod 755 the home dir, then add o+x to every directory
-# lacking it (apache/nginx run as their own user and must traverse). Run AS THE
-# CUSTOMER: `find -type d` without -L skips symlinks, but chmod would follow a
-# dir swapped for a symlink between find and chmod; as the customer that can
-# only reach what the customer already owns.
-open_dir_traversal() {
-  chmod 755 "/home/$user"
-  as_user find "/home/$user" -type d ! -perm -o=x -exec chmod o+x {} + 2>/dev/null || true
-}

scripts/stop-services.sh

@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-## stop-services.sh — sourced by the bash PID-1 entrypoints (entrypoint.sh,
-## entrypoint-fpm.sh, entrypoint-shared-httpd.sh). Not executed directly.
-##
-## Why this exists: those entrypoints end with bash as PID 1 tailing logs.
-## The kernel never delivers a signal to PID 1 unless PID 1 installed a handler
-## for it, so `docker stop`'s SIGTERM was silently dropped. Docker waited the
-## full stop timeout (10s) and then SIGKILLed the whole container, killing
-## apache / php-fpm mid-request (exit 137). The entrypoints now trap TERM/INT
-## and call stop_service for each daemon they started, then exit 0.
-##
-## Budget: docker's default stop timeout is 10s. Callers pass per-service
-## timeouts that sum to < 10s so the graceful path always completes before
-## docker gives up and SIGKILLs.
-
-# A pid counts as alive if it exists and is not a zombie. bash (PID 1) reaps
-# the daemons it adopted, but between exit and reap a zombie still answers
-# `kill -0`, so check /proc state too.
-_svc_alive() {
-  [ -n "$1" ] || return 1
-  kill -0 "$1" 2>/dev/null || return 1
-  ! grep -qs '^State:[[:space:]]*Z' "/proc/$1/status"
-}
-
-# stop_service NAME PIDFILE GRACEFUL_SIGNAL GRACE_SECONDS [PGREP_PATTERN]
-# Sends GRACEFUL_SIGNAL, waits up to GRACE_SECONDS for the process to exit,
-# then sends TERM and waits 1s more, then KILL. Pid comes from PIDFILE, or
-# from `pgrep -o -f PGREP_PATTERN` when the pidfile is missing/stale.
-stop_service() {
-  local name=$1 pidfile=$2 sig=$3 grace=$4 pat=${5:-} pid="" i
-  [ -r "$pidfile" ] && pid=$(tr -dc '0-9' < "$pidfile")
-  if ! _svc_alive "$pid" && [ -n "$pat" ]; then
-    pid=$(pgrep -o -f "$pat" 2>/dev/null)
-  fi
-  if ! _svc_alive "$pid"; then
-    echo "entrypoint: $name not running"
-    return 0
-  fi
-  echo "entrypoint: stopping $name (pid $pid) with SIG$sig"
-  kill -s "$sig" "$pid" 2>/dev/null
-  for ((i = 0; i < grace * 10; i++)); do
-    _svc_alive "$pid" || { echo "entrypoint: $name stopped"; return 0; }
-    sleep 0.1
-  done
-  echo "entrypoint: $name still running after ${grace}s, sending SIGTERM"
-  kill -TERM "$pid" 2>/dev/null
-  for ((i = 0; i < 10; i++)); do
-    _svc_alive "$pid" || { echo "entrypoint: $name stopped"; return 0; }
-    sleep 0.1
-  done
-  echo "entrypoint: $name still running, sending SIGKILL"
-  kill -KILL "$pid" 2>/dev/null
-  return 0
-}