Commit Graph

Select branches

Hide Pull Requests

ci/drop-eol-php

feat/lsphp-source-emergency

feat/lsphp-upgrade-at-build

feat/pkg-cache-build-arg

feature/cac-lsphp-image

fix/ci-no-fail-fast

fix/lsphp-enable-user-ini

fix/lsphp-upgrade-pipefail

fix/no-recursive-chmod-on-start

fix/php2shell-ini-mitigation

fix/remi-origin

fix/remi-origin-https

fix/shared-ols-catchall-421

trunk

#1

#10

#11

#12

#13

#14

#15

#16

#17

#18

#19

#2

#20

#21

#22

#23

#24

#25

#26

#27

#28

#29

#3

#30

#31

#32

#33

#34

#35

#36

#4

#5

#6

#7

#8

#9

Mono Color

• e7d4db5bd3 Merge pull request 'fix(cac): healthcheck fails only on no answer or 5xx, not 4xx' (#34) from fix/healthcheck-4xx into trunk trunk jknapp 2026-10-22 15:04:10 +00:00
• 0fee1b54c4 Merge pull request 'pkg-cache: Debian/NodeSource/Go/EL9 modes; wire cac-litespeed + cac-lsphp; docs' (#36) from ci/pkg-cache-more-upstreams into trunk jknapp 2026-10-22 14:35:51 +00:00
• 9baa7a6029 docs(pkg-cache): new upstreams, modes, wired repos, how to add an upstream shadowdaoandClaude Opus 5.5 2026-10-22 07:35:36 -07:00
• 3a6cab19ee ci: wire cac-litespeed and cac-lsphp to the package cache and digest-pinned base shadowdaoandClaude Opus 5.5 2026-10-22 07:11:52 -07:00
• 6a11fc9894 feat(pkg-cache): Debian, NodeSource, Go proxy and EL9 support in pkg-cache-repos.sh shadowdaoandClaude Opus 5.5 2026-10-22 07:08:22 -07:00
• 05ad47a833 Merge pull request 'ci: pin base images by digest resolved directly from Docker Hub' (#35) from ci/base-image-digest-pin into trunk jknapp 2026-10-22 13:59:04 +00:00
• d1547f3418 ci: pin base images by digest resolved directly from Docker Hub shadowdaoandClaude Opus 5.5 2026-10-22 06:58:16 -07:00
• a00a3c7fc3 fix(cac): healthcheck fails only on no answer or 5xx, not 4xx shadowdaoandClaude Opus 5.5 2026-10-22 05:41:40 -07:00
• 3334f94cd5 Merge pull request 'ci: stop building PHP 7.4, 8.0 and 8.1 images' (#33) from ci/drop-eol-php into trunk jknapp 2026-10-22 01:13:20 +00:00
• 76fc53358c ci: stop building PHP 7.4, 8.0 and 8.1 images ci/drop-eol-php shadowdaoandClaude Opus 5.5 2026-10-21 18:13:18 -07:00
• fc60ac5ef3 Merge pull request 'fix(pkg-cache): no | while read pipelines under pipefail (Shell-Checks)' (#32) from fix/pkg-cache-shellcheck-pipefail into trunk jknapp 2026-10-21 23:48:21 +00:00
• 472fdcbc4d fix(pkg-cache): no | while read pipelines under pipefail shadowdaoandClaude Opus 5.5 2026-10-21 16:48:17 -07:00
• cb0cecb557 Merge pull request 'feat(build): opt-in PKG_CACHE build arg for the internal package cache (HTTPS, GPG-verified)' (#31) from feat/pkg-cache-build-arg into trunk jknapp 2026-10-21 23:46:39 +00:00
• 2b9e7f302c ci: enable PKG_CACHE via a TLS probe that falls back to upstream; host repo tool feat/pkg-cache-build-arg shadowdaoandClaude Opus 5.5 2026-10-21 16:46:03 -07:00
• 18f65c6d84 fix(pkg-cache): HTTPS-only cache, GPG-verified release RPMs, strict restore shadowdaoandClaude Opus 5.5 2026-10-21 12:53:24 -07:00
• b2bec5b3ee feat(build): opt-in PKG_CACHE build arg for the internal package cache shadowdaoandClaude Opus 5.5 2026-10-21 12:29:54 -07:00
• fa7808897f Merge pull request 'feat(lsphp): emergency lsphp build from php.net source (same support as packaged)' (#30) from feat/lsphp-source-emergency into trunk jknapp 2026-10-21 16:48:40 +00:00
• 42993f42bd ci(security): no ${{ }} in run:, validate resolved versions, LiteSpeed index over HTTPS feat/lsphp-source-emergency shadowdaoandClaude Opus 5.5 2026-10-21 09:47:44 -07:00
• 83c2ee9c2a feat(lsphp): emergency build path compiling lsphp from php.net source shadowdaoandClaude Opus 5.5 2026-10-21 09:43:45 -07:00
• be1540f559 Merge pull request 'fix(images): Remi origin over HTTPS first; fail builds older than php.net' (#29) from fix/remi-origin-https into trunk jknapp 2026-10-21 15:29:41 +00:00
• af7fd193e5 fix(images): Remi origin over HTTPS first; fail builds older than php.net fix/remi-origin-https shadowdaoandClaude Opus 5.5 2026-10-21 08:29:31 -07:00
• e8e3bfd490 Merge pull request 'fix(images): install Remi packages from the origin, not the lagging mirrors' (#28) from fix/remi-origin into trunk jknapp 2026-10-21 15:02:41 +00:00
• c49f456336 fix(images): install Remi packages from the origin, not the lagging mirrors fix/remi-origin shadowdaoandClaude Opus 5.5 2026-10-21 08:02:38 -07:00
• bcd737a9e2 Merge pull request 'ci: fail-fast false on every image matrix' (#27) from fix/ci-no-fail-fast into trunk jknapp 2026-10-21 14:55:53 +00:00
• 955aec4573 ci: fail-fast false on every image matrix fix/ci-no-fail-fast shadowdaoandClaude Opus 5.5 2026-10-21 07:55:49 -07:00
• 998eb17f39 Merge pull request 'fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed' (#26) from fix/php2shell-ini-mitigation into trunk jknapp 2026-10-21 14:22:07 +00:00
• f461d22aae fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed fix/php2shell-ini-mitigation shadowdaoandClaude Opus 5.5 2026-10-21 07:21:47 -07:00
• cfde82ae44 Merge pull request 'fix(lsphp-apt-upgrade): no early-exit readers under pipefail' (#25) from fix/lsphp-upgrade-pipefail into trunk jknapp 2026-10-21 14:07:07 +00:00
• 132e591503 fix(lsphp-apt-upgrade): no early-exit readers under pipefail fix/lsphp-upgrade-pipefail shadowdaoandClaude Opus 5.5 2026-10-21 07:07:05 -07:00
• 642b97707d Merge pull request 'feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version' (#24) from feat/lsphp-upgrade-at-build into trunk jknapp 2026-10-21 13:08:15 +00:00
• 71ca114529 feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version feat/lsphp-upgrade-at-build shadowdaoandClaude Opus 5.5 2026-10-21 06:07:48 -07:00
• 74e12407f8 Merge pull request 'fix(entrypoint): no recursive chmod, graceful stop, fpm error_log owner, symlink-safe root paths, dotfile deny' (#23) from fix/no-recursive-chmod-on-start into trunk jknapp 2026-10-21 00:01:29 +00:00
• 74648ba34b fix(security): deny config/VCS dotfiles over HTTP on standalone cac and cac-litespeed fix/no-recursive-chmod-on-start shadowdaoandClaude Opus 5.5 2026-10-20 16:31:56 -07:00
• 86a88c87db fix(safe-paths): unlink planted symlinks as the customer, then fail closed shadowdaoandClaude Opus 5.5 2026-10-20 16:06:41 -07:00
• 02d93f4d1a fix(safe-paths): fail closed on planted symlinks before root daemons start shadowdaoandClaude Opus 5.5 2026-10-20 16:04:21 -07:00
• 94a73ea8ab fix(safe-paths): unlink symlinks and create files as the customer, never as root shadowdaoandClaude Opus 5.5 2026-10-20 15:52:01 -07:00
• 0ffccac4b8 fix(entrypoint): root never follows customer symlinks under /home/$user shadowdaoandClaude Opus 5.5 2026-10-20 15:49:18 -07:00
• eaf616eb30 fix(entrypoint): graceful docker stop + cac-fpm error_log owner on first start shadowdaoandClaude Opus 5.5 2026-10-20 15:44:14 -07:00
• 14761597bb fix(entrypoint): stop chmod -R 755 on the customer docroot every start shadowdaoandClaude Opus 5.5 2026-10-20 12:33:29 -07:00
• db19ee24c3 ci: add workflow_dispatch trigger for manual rebuilds jknapp 2026-09-28 03:15:17 +00:00
• 3841b18820 fix(shared-ols): enableCache 0 so headerless responses are never cached shadowdaoandClaude Sonnet 5 2026-09-21 06:55:02 -07:00
• 48b714447f chore: pin the shared-memory project key shadowdaoandClaude Opus 5 2026-08-23 08:09:04 -07:00
• 11c02d94ec fix(shared-ols): unmapped Host gets 421, not a 200 that hides a dead site fix/shared-ols-catchall-421 shadowdaoandClaude Opus 5 2026-08-22 19:44:01 -07:00
• ba9650ee45 Merge branch 'fix/ols-watcher-scope' shadowdao 2026-08-13 21:39:37 -07:00
• 77af001af6 fix(ols): pin procps explicitly for pgrep dependency shadowdao 2026-08-13 21:39:14 -07:00
• cf6936e225 fix(ols): scope the htaccess watcher to docroots, stop lswsctrl status log spam shadowdaoandClaude Opus 5 2026-08-13 21:29:48 -07:00
• b92725d2ec Merge branch 'fix/lsphp-keep-listen' shadowdao 2026-08-13 15:03:49 -07:00
• 5e83c8db3b fix(lsphp): set LSAPI_KEEP_LISTEN=2 to stop idle-exit timing from following the leaked busy counter shadowdaoandClaude Opus 5 2026-08-13 14:47:08 -07:00
• a325615690 Merge branch 'fix/lsphp-pipefail-sigpipe' shadowdaoandClaude Opus 5 2026-08-05 16:04:13 -07:00
• e28c3dcce4 fix(lsphp): correct the SIGPIPE explanation, drop the temp-dir boot precondition, close two scanner blind spots shadowdaoandClaude Opus 5 2026-08-05 16:03:08 -07:00
• 584099ff19 docs: record boot-posture and CI-gating decisions shadowdaoandClaude Opus 5 2026-08-05 15:43:18 -07:00
• 8790b027a9 fix(lsphp): stop SIGPIPE+pipefail reporting the parity extension as missing shadowdaoandClaude Opus 5 2026-08-05 15:23:56 -07:00
• 9343a56ccf Merge branch 'fix/lsphp-parity-hardening' shadowdaoandClaude Opus 5 2026-08-05 14:09:53 -07:00
• 3047123f2b docs(lsphp): correct three comments that overstated what the code does shadowdaoandClaude Opus 5 2026-08-05 14:08:09 -07:00
• 07378506a7 harden(cac-lsphp): close the two remaining unvetted ini emissions; stop MINFO lying Claude 2026-08-05 13:46:52 -07:00
• 9761157a6b harden(cac-path-parity): make degenerate mappings inert instead of subtly wrong shadowdaoandClaude Opus 5 2026-08-05 13:06:34 -07:00
• 61bfdcfaf9 test(cac-path-parity): run the .phpt suite as a build gate shadowdaoandClaude Opus 5 2026-08-05 13:06:23 -07:00
• fb4946641a fix(cac-path-parity): make the FPM proof harness actually runnable as shipped shadowdaoandClaude Opus 5 2026-08-05 13:06:10 -07:00
• 690ff8738d fix(cac-lsphp): stop generating php.ini fragments from unquoted interpolation shadowdaoandClaude Opus 5 2026-08-05 13:05:57 -07:00
• 06df1c410b fix(cac-lsphp): pin the shipped lsphp to the version the .so was built against shadowdaoandClaude Opus 5 2026-08-05 13:05:36 -07:00
• a3aa9f2b26 fix(lsphp): repair the comment my sed mangled shadowdaoandClaude Opus 5 2026-08-05 11:41:28 -07:00
• 83522b00ef Merge branch 'feat/lsphp-server-path-parity' shadowdao 2026-08-05 11:41:03 -07:00
• 15e304e0c3 docs(lsphp): the build assertion probes with -i, not -m shadowdaoandClaude Opus 5 2026-08-05 11:41:03 -07:00
• da16faaff5 feat(cac-lsphp): guarantee $_SERVER path parity via a PHP extension shadowdaoandClaude Opus 5 2026-08-05 11:38:19 -07:00
• 03b8f3f730 Merge pull request 'fix(cac-lsphp): enable .user.ini support (LSPHP_ENABLE_USER_INI)' (#21) from fix/lsphp-enable-user-ini into trunk jknapp 2026-08-02 22:38:03 +00:00
• 433e74975c fix(cac-lsphp): enable .user.ini support (LSPHP_ENABLE_USER_INI) fix/lsphp-enable-user-ini Claude 2026-08-02 15:23:05 -07:00
• cc72fda741 Merge pull request 'fix(shared-ols): never cache logged-in pages (disable tier private cache)' (#20) from fix/shared-ols-no-logged-in-cache into trunk jknapp 2026-06-27 04:04:49 +00:00
• a865a13940 fix(shared-ols): never cache logged-in pages (disable tier private cache) shadowdaoandClaude Opus 4.8 2026-06-26 20:58:23 -07:00
• 8dbfdf599a fix(shared-ols): useIpInProxyHeader 2->1 so real client IP reaches lsphp shadowdaoandClaude Opus 4.8 2026-06-11 07:55:42 -07:00
• 2e85f458d3 Merge pull request 'feat: OLS tier images — cac-lsphp (detached lsphp) + shared-ols' (#19) from feature/cac-lsphp-image into trunk jknapp 2026-06-10 16:56:38 +00:00
• 08f35032c5 fix(shared-ols): re-review hardening — bounded flock + stale-tmp sweep feature/cac-lsphp-image shadowdaoandClaude Opus 4.8 2026-06-10 09:25:05 -07:00
• 6bb494c72f fix(shared-ols): review fixes — watcher starvation, atomic render, O(N) chown, safe meta parse shadowdaoandClaude Opus 4.8 2026-06-10 08:34:55 -07:00
• 7552760ba0 fix(cac-lsphp): normalize $_SERVER DOCUMENT_ROOT/SCRIPT_FILENAME to /home shadowdaoandClaude Opus 4.8 2026-06-10 07:02:54 -07:00
• fc65b68bd6 fix(cac-lsphp): mount docroot at /home/$user + symlink for true 1:1 compatibility shadowdaoandClaude Opus 4.8 2026-06-10 06:54:28 -07:00
• e99b8cb2d1 fix(cac-lsphp): entrypoint operates on the /mnt/users docroot, not /home/$user shadowdaoandClaude Opus 4.8 2026-06-10 06:42:31 -07:00
• 19db8f170a feat(shared-ols): shared OpenLiteSpeed tier image (webserver-only, fronts cac-lsphp sidecars) shadowdaoandClaude Opus 4.8 2026-06-10 01:22:14 -07:00
• 19092911a3 feat(cac-lsphp): detached lsphp (LSAPI) site image for the shared-ols tier shadowdaoandClaude Opus 4.8 2026-06-09 18:28:34 -07:00
• 50202538e4 cac-litespeed: supervise OLS in daemon mode so self-restarts don't kill PID 1 shadowdaoandClaude Opus 4.8 2026-06-05 19:15:25 -07:00
• 2837d40f00 cac-litespeed: forward real client IP to logs and PHP behind HAProxy shadowdaoandClaude Opus 4.8 2026-06-04 15:51:25 -07:00
• cfdaae116a tune(litespeed): bump opcache 32→64 MB / 4000→8000 files + add per-site override shadowdaoandClaude Opus 4.7 2026-06-03 06:21:37 -07:00
• 87f154cdc8 refactor(litespeed): drop setUIDMode for shared lsphp + cut opcache 128→32M shadowdaoandClaude Opus 4.7 2026-06-02 20:06:56 -07:00
• f463519998 tune(litespeed): bump LSPHP_WORKER_ESTIMATE_MB 115 → 130 shadowdaoandClaude Opus 4.7 2026-06-02 18:54:28 -07:00
• 03cca745f7 feat(litespeed): wire up dynamic LSAPI tuning + idle reduction shadowdaoandClaude Opus 4.7 2026-06-02 16:36:25 -07:00
• d1c3cfadc0 feat(litespeed): make log paths drop-in compatible with cac:phpNN shadowdaoandClaude Opus 4.7 2026-06-02 10:53:44 -07:00
• 80fa06592b perf(litespeed): defer mariadb-server + memcached install to DEV runtime shadowdaoandClaude Opus 4.7 2026-06-02 08:26:19 -07:00
• 9e13571d61 Drop stale configs/litespeed/vhconf.tpl shadowdaoandClaude Opus 4.7 2026-06-02 07:33:06 -07:00
• 55c28a0c11 Add cac-litespeed image family (OpenLiteSpeed, native LSAPI) shadowdaoandClaude Opus 4.7 2026-06-02 07:32:47 -07:00
• 1756d496e5 detect-memory: raise PHP_WORKER_ESTIMATE_MB default 60→128 Claude Code 2026-06-01 08:23:09 -07:00
• d5d027c0ab chore(ci): trigger fresh build to verify older PHP tags repopulate shadowdaoandClaude Opus 4.7 2026-05-29 07:59:12 -07:00
• 28bb1055da Use proxy_block placeholder in vhost template for FPM load balancing shadowdaoandClaude Opus 4.6 2026-04-02 09:03:11 -07:00
• e9604b8721 Fix shared httpd log tailing for dynamically added vhosts shadowdaoandClaude Opus 4.6 2026-04-01 22:22:10 -07:00
• e81b0df5b8 Reduce idle PHP-FPM memory footprint shadowdaoandClaude Opus 4.6 2026-04-01 15:58:42 -07:00
• c65f533dcc Add HEIC/HEIF/AVIF support + fix MariaDB repo for AlmaLinux 10 shadowdaoandClaude Opus 4.6 2026-04-01 15:48:58 -07:00
• c6f1f42987 Final vhost template: SetHandler + ProxyFCGISetEnvIf for both paths shadowdaoandClaude Opus 4.6 2026-04-01 13:58:11 -07:00
• e20f5620d7 Fix DOCUMENT_ROOT for PHP-FPM in shared httpd mode shadowdaoandClaude Opus 4.6 2026-04-01 13:04:53 -07:00
• 1490bde56e Switch shared vhost from SetHandler to ProxyPassMatch for PHP-FPM shadowdaoandClaude Opus 4.6 2026-04-01 12:50:54 -07:00
• e5e055d198 Fix ProxyFCGISetEnvIf syntax for SCRIPT_FILENAME rewrite shadowdaoandClaude Opus 4.6 2026-04-01 12:32:52 -07:00
• c68b555a5f Fix PHP-FPM path mismatch in shared httpd vhost template shadowdaoandClaude Opus 4.6 2026-04-01 12:22:53 -07:00
• 7f7cb456f0 Add openssl to package installs for AlmaLinux 10 shadowdaoandClaude Opus 4.6 2026-04-01 11:11:10 -07:00
• dc6ce2bf12 Upgrade base image from AlmaLinux 9 to AlmaLinux 10 shadowdaoandClaude Opus 4.6 2026-04-01 10:55:26 -07:00