The shared-OLS catch-all (`map _health *`) served html/index.html -- HTTP 200, 11 bytes, "shared-ols" -- to any Host no customer vhost claimed. Three live customer sites (joshuaknapp.net, streamers.channel, blog.anti-social.online) sat in exactly that state for ~2 months on whp01 and no monitor noticed, because every uptime check asks "is it 200?" and it was. A tier-wide catch-all that answers 200 makes a missing vhost indistinguishable from a working site. An unmapped Host now gets 421 Misdirected Request with a short generic body. 421 is semantically exact (the server cannot produce a response for the requested authority) and, unlike 404, cannot be confused with a normal answer from a real site. The discriminator is the request path plus the client address, NOT the Host -- the vhost is selected by the listener map, so by the time these rules run the Host is no longer available to branch on: * `/healthz` from an internal client address (loopback, RFC1918) -> 200 "ok" * everything else, every path, every Host, both listeners -> 421 The 421 for `/` is UNCONDITIONAL: no header, source address or Host talks this vhost into a 200 there, so the property the change exists to guarantee does not rest on anything spoofable. The address gate only hardens /healthz, and X-Forwarded-For cannot be used against it because HAProxy replaces that header with the real client IP. Health probes keep passing unchanged. Both forms were run against a container carrying this change and both exit 0 with "ok": curl -fsSk https://127.0.0.1/healthz (Dockerfile.shared-ols HEALTHCHECK) curl -sfk https://localhost/healthz (WHP setup-shared-ols.sh --health-cmd) `docker inspect` reported healthy with failingStreak=0, on a container with a customer site and on a zero-site container. Measured on the lab VM against OLS 1.8.4 (the production base image): unmapped Host, `/`, :443 and :80 -> 421, 356 bytes, identical for every unmapped Host (no enumeration signal) unmapped Host, any deeper path -> the same 421 configured site, both names, :443/:80 -> 200, served normally litespeed -t -> 0 [ERROR] lines (warnings only, and only about the lab fixture's uid/gid) Two OLS behaviours were measured rather than assumed, and both shaped the implementation -- see the comment block in entrypoint-shared-ols.sh: `context / { type redirect statusCode 421 }` silently degrades to a 302 with an unexpanded Location, and the `errorpage 421` body is fetched as a fresh request through the same rewrite rules (so it needs a %{THE_REQUEST} guard, since %{IS_SUBREQ} and %{ENV:REDIRECT_STATUS} are not populated). The old index.html is removed, not just bypassed: if these rules ever stopped applying, `context /` would fall back to the docRoot index, and with no index.html that is a 403 -- wrong-but-loud, rather than a 200 that is wrong-and-silent. Known consumer to land alongside this: whp-monitoring's probe_shared_ols_catchall() currently detects the catch-all by matching `200` + body `shared-ols`, a signature this change deletes. It must also accept 421, or the detector silently stops detecting. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Cloud Apache Container
This is a base container for running PHP-based applications, supporting multiple PHP versions (7.4, 8.0, 8.1, 8.2, 8.3, 8.4). The default is PHP 8.3. The container is based on AlmaLinux 9 and uses Apache with mod_ssl. It is designed for both development and production use.
You must have Docker or compatible containerization software running.
What's New?
- Optimized Image: The Dockerfile has been refactored for smaller size, faster builds, and improved security. Unnecessary files and caches are removed during build.
- Pre-built Images for Each PHP Version: On every push, images for all supported PHP versions are built and pushed to the registry. You can pull the exact version you need (e.g.,
cac:php74,cac:php84, orcac:latest). - .dockerignore Added: The build context is now minimized, making builds faster and more secure.
Quick Start: Local Development with local-dev.sh
The easiest way to start a local development environment is with the provided local-dev.sh script. This script automates container setup, volume creation, log directories, and WordPress installation.
Usage Example
./local-dev.sh -n local-dev
Flags:
-nName of the container (required)-pHTTP port (default: 80)-sHTTPS port (default: 443)-rRoot path for files and database (default: current directory)-aPHP version (default: 8.3; options: 74, 80, 81, 82, 83, 84)-vEnable verbose mode-hShow help
The script will:
- Create a user directory and log folders
- Create a Docker volume for MySQL
- Start the container with the correct environment variables
- Generate helper scripts in your root path:
instance_start– Start the containerinstance_stop– Stop the containerinstance_logs– Tail Apache logsinstance_db_info– Show MySQL credentials
- Install WordPress in your web root
- Print MySQL credentials
Manual Docker Usage
You can also run the container manually:
mkdir -p local-development/domain.tld
cd local-development/domain.tld
mkdir user
mkdir -p user/logs/{apache,system}
docker run -d -it -p 80:80 -p 443:443 -e PHPVER=84 -e environment=DEV --mount type=bind,source="$(pwd)"/user,target=/home/myuser -v"$name-mysql":/var/lib/mysql -e uid=30001 -e user=myuser -e domain=localhost --name local-dev repo.anhonesthost.net/cloud-hosting-platform/cac:latest
Accessing the Container
docker exec -it local-dev /bin/bash
WordPress Installation
If using local-dev.sh, WordPress is installed automatically. For manual setup:
cat /home/myuser/mysql_creds
su - myuser
cd ~/public_html
wp core download
Then visit https://localhost (accept the SSL warning) to complete setup.
Features
- Multiple PHP Versions: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 (set with
PHPVERor-aflag) - Pre-built Images: Pull the image for your desired PHP version directly from the registry. No need to build locally unless customizing.
- Optimized Build: Smaller, faster, and more secure images thanks to the improved Dockerfile and
.dockerignore. - Automatic Database Setup: MariaDB is started in DEV mode, credentials are auto-generated and stored in
/home/$user/mysql_creds. - Database Backups: Cron job backs up the database every 15 minutes to
/home/$user/_db_backups. - Log Management: Log rotation compresses logs older than 3 days and deletes those older than 7 days.
- Memcached: Started automatically in DEV mode.
- SSL: Self-signed certificate enabled by default.
- Default Web Content:
/home/$user/public_htmlis the web root./pingendpoint andphpinfo.phpare available for diagnostics. - Helper Scripts:
instance_start,instance_stop,instance_logs,instance_db_info(created bylocal-dev.sh).
Environment Variables
Required:
uid– User ID for file permissionsuser– Username for file permissionsdomain– Primary domain for configuration
Optional:
environment– Set toDEVto start memcached and MySQL locally for developmentserveralias– Comma-separated list of alternative hostnamesPHPVER– PHP version (see above)
Helpful Notes
- To restart the instance:
./instance_startordocker start {container-name} - To stop:
./instance_stopordocker stop {container-name} - To view logs:
./instance_logsordocker logs -f {container-name} - To get DB credentials:
./instance_db_infoorcat /home/$user/mysql_creds - To delete a container:
docker rm {container-name}(does not delete user files or DB volume) - To view running containers:
docker ps - To view all containers:
docker ps --all - To view images:
docker images
Troubleshooting
- The first run may take several minutes as dependencies are installed.
- If you need to change PHP version, stop and remove the container, then recreate with the desired version.
- For advanced configuration, see the scripts in the
scripts/directory. - The image is optimized for size and speed, but local development in DEV mode may install additional packages (MariaDB, memcached) at runtime using microdnf.
- The build context is minimized by the included
.dockerignorefile.