shadowdaoandClaude Opus 5 11c02d94ec fix(shared-ols): unmapped Host gets 421, not a 200 that hides a dead site
The shared-OLS catch-all (`map _health *`) served html/index.html --
HTTP 200, 11 bytes, "shared-ols" -- to any Host no customer vhost claimed.
Three live customer sites (joshuaknapp.net, streamers.channel,
blog.anti-social.online) sat in exactly that state for ~2 months on whp01
and no monitor noticed, because every uptime check asks "is it 200?" and
it was. A tier-wide catch-all that answers 200 makes a missing vhost
indistinguishable from a working site.

An unmapped Host now gets 421 Misdirected Request with a short generic
body. 421 is semantically exact (the server cannot produce a response for
the requested authority) and, unlike 404, cannot be confused with a normal
answer from a real site.

The discriminator is the request path plus the client address, NOT the
Host -- the vhost is selected by the listener map, so by the time these
rules run the Host is no longer available to branch on:

  * `/healthz` from an internal client address (loopback, RFC1918) -> 200 "ok"
  * everything else, every path, every Host, both listeners -> 421

The 421 for `/` is UNCONDITIONAL: no header, source address or Host talks
this vhost into a 200 there, so the property the change exists to
guarantee does not rest on anything spoofable. The address gate only
hardens /healthz, and X-Forwarded-For cannot be used against it because
HAProxy replaces that header with the real client IP.

Health probes keep passing unchanged. Both forms were run against a
container carrying this change and both exit 0 with "ok":
  curl -fsSk https://127.0.0.1/healthz   (Dockerfile.shared-ols HEALTHCHECK)
  curl -sfk  https://localhost/healthz   (WHP setup-shared-ols.sh --health-cmd)
`docker inspect` reported healthy with failingStreak=0, on a container with
a customer site and on a zero-site container.

Measured on the lab VM against OLS 1.8.4 (the production base image):
  unmapped Host, `/`, :443 and :80   -> 421, 356 bytes, identical for every
                                        unmapped Host (no enumeration signal)
  unmapped Host, any deeper path     -> the same 421
  configured site, both names, :443/:80 -> 200, served normally
  litespeed -t                        -> 0 [ERROR] lines (warnings only, and
                                        only about the lab fixture's uid/gid)

Two OLS behaviours were measured rather than assumed, and both shaped the
implementation -- see the comment block in entrypoint-shared-ols.sh:
`context / { type redirect statusCode 421 }` silently degrades to a 302
with an unexpanded Location, and the `errorpage 421` body is fetched as a
fresh request through the same rewrite rules (so it needs a %{THE_REQUEST}
guard, since %{IS_SUBREQ} and %{ENV:REDIRECT_STATUS} are not populated).

The old index.html is removed, not just bypassed: if these rules ever
stopped applying, `context /` would fall back to the docRoot index, and
with no index.html that is a 403 -- wrong-but-loud, rather than a 200 that
is wrong-and-silent.

Known consumer to land alongside this: whp-monitoring's
probe_shared_ols_catchall() currently detects the catch-all by matching
`200` + body `shared-ols`, a signature this change deletes. It must also
accept 421, or the detector silently stops detecting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-22 19:44:01 -07:00
2025-07-28 07:29:03 -07:00

Cloud Apache Container

This is a base container for running PHP-based applications, supporting multiple PHP versions (7.4, 8.0, 8.1, 8.2, 8.3, 8.4). The default is PHP 8.3. The container is based on AlmaLinux 9 and uses Apache with mod_ssl. It is designed for both development and production use.

You must have Docker or compatible containerization software running.


What's New?

  • Optimized Image: The Dockerfile has been refactored for smaller size, faster builds, and improved security. Unnecessary files and caches are removed during build.
  • Pre-built Images for Each PHP Version: On every push, images for all supported PHP versions are built and pushed to the registry. You can pull the exact version you need (e.g., cac:php74, cac:php84, or cac:latest).
  • .dockerignore Added: The build context is now minimized, making builds faster and more secure.

Quick Start: Local Development with local-dev.sh

The easiest way to start a local development environment is with the provided local-dev.sh script. This script automates container setup, volume creation, log directories, and WordPress installation.

Usage Example

./local-dev.sh -n local-dev

Flags:

  • -n Name of the container (required)
  • -p HTTP port (default: 80)
  • -s HTTPS port (default: 443)
  • -r Root path for files and database (default: current directory)
  • -a PHP version (default: 8.3; options: 74, 80, 81, 82, 83, 84)
  • -v Enable verbose mode
  • -h Show help

The script will:

  • Create a user directory and log folders
  • Create a Docker volume for MySQL
  • Start the container with the correct environment variables
  • Generate helper scripts in your root path:
    • instance_start Start the container
    • instance_stop Stop the container
    • instance_logs Tail Apache logs
    • instance_db_info Show MySQL credentials
  • Install WordPress in your web root
  • Print MySQL credentials

Manual Docker Usage

You can also run the container manually:

mkdir -p local-development/domain.tld
cd local-development/domain.tld
mkdir user
mkdir -p user/logs/{apache,system}
docker run -d -it -p 80:80 -p 443:443 -e PHPVER=84 -e environment=DEV --mount type=bind,source="$(pwd)"/user,target=/home/myuser -v"$name-mysql":/var/lib/mysql -e uid=30001 -e user=myuser -e domain=localhost --name local-dev  repo.anhonesthost.net/cloud-hosting-platform/cac:latest

Accessing the Container

docker exec -it local-dev /bin/bash

WordPress Installation

If using local-dev.sh, WordPress is installed automatically. For manual setup:

cat /home/myuser/mysql_creds
su - myuser
cd ~/public_html
wp core download

Then visit https://localhost (accept the SSL warning) to complete setup.


Features

  • Multiple PHP Versions: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 (set with PHPVER or -a flag)
  • Pre-built Images: Pull the image for your desired PHP version directly from the registry. No need to build locally unless customizing.
  • Optimized Build: Smaller, faster, and more secure images thanks to the improved Dockerfile and .dockerignore.
  • Automatic Database Setup: MariaDB is started in DEV mode, credentials are auto-generated and stored in /home/$user/mysql_creds.
  • Database Backups: Cron job backs up the database every 15 minutes to /home/$user/_db_backups.
  • Log Management: Log rotation compresses logs older than 3 days and deletes those older than 7 days.
  • Memcached: Started automatically in DEV mode.
  • SSL: Self-signed certificate enabled by default.
  • Default Web Content: /home/$user/public_html is the web root. /ping endpoint and phpinfo.php are available for diagnostics.
  • Helper Scripts: instance_start, instance_stop, instance_logs, instance_db_info (created by local-dev.sh).

Environment Variables

Required:

  • uid User ID for file permissions
  • user Username for file permissions
  • domain Primary domain for configuration

Optional:

  • environment Set to DEV to start memcached and MySQL locally for development
  • serveralias Comma-separated list of alternative hostnames
  • PHPVER PHP version (see above)

Helpful Notes

  • To restart the instance: ./instance_start or docker start {container-name}
  • To stop: ./instance_stop or docker stop {container-name}
  • To view logs: ./instance_logs or docker logs -f {container-name}
  • To get DB credentials: ./instance_db_info or cat /home/$user/mysql_creds
  • To delete a container: docker rm {container-name} (does not delete user files or DB volume)
  • To view running containers: docker ps
  • To view all containers: docker ps --all
  • To view images: docker images

Troubleshooting

  • The first run may take several minutes as dependencies are installed.
  • If you need to change PHP version, stop and remove the container, then recreate with the desired version.
  • For advanced configuration, see the scripts in the scripts/ directory.
  • The image is optimized for size and speed, but local development in DEV mode may install additional packages (MariaDB, memcached) at runtime using microdnf.
  • The build context is minimized by the included .dockerignore file.
S
Description
No description provided
Readme
595 KiB
Languages
Shell 77.3%
C 8.3%
Go Template 8%
PHP 5%
Dockerfile 1.1%
Other 0.3%