shadowdaoandClaude Opus 5.5
14761597bb
entrypoint.sh and entrypoint-fpm.sh ran `chmod -R 755 /home/$user` on every container start. /home/$user is the bind-mounted customer site directory, so every file (wp-config.php included) became world-readable and executable, and any tighter permissions the customer set were reverted on each restart. The line dates from the initial commit (95b9397) and was copied into the FPM entrypoint (c781678); neither gives a reason. The legitimate need is that Apache (bundled httpd, or shared-httpd reading /mnt/users/...) runs as `apache`, not the customer, and must be able to traverse directories to serve static files. Keep the recursive chown. Replace the recursive chmod with: - chmod 755 on the docroot directory itself (matches entrypoint-litespeed.sh) - o+x on directories that lack it (find -type d ! -perm -o=x) Regular files are never touched: execute is never added, and wp-config.php or any other customer-restricted file is never loosened. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
97 lines
3.5 KiB
Bash
Executable File
97 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
if [ -z "$PHPVER" ]; then
|
|
PHPVER="83";
|
|
fi
|
|
|
|
if [ -z "$environment" ]; then
|
|
environment="PROD"
|
|
fi
|
|
|
|
# Default to FPM-only role
|
|
export CONTAINER_ROLE="fpm_only"
|
|
export FPM_LISTEN=${FPM_LISTEN:-9000}
|
|
|
|
adduser -u $uid $user
|
|
|
|
mkdir -p /home/$user/public_html
|
|
mkdir -p /home/$user/logs/php-fpm
|
|
|
|
ln -sf /home/$user/logs/php-fpm /var/log/php-fpm
|
|
|
|
source /scripts/detect-memory.sh
|
|
echo "Container memory: ${CONTAINER_MEMORY_MB}MB | PHP-FPM pm=${PHP_FPM_PM} max_children=${PHP_FPM_MAX_CHILDREN} | Listen=${FPM_LISTEN}"
|
|
|
|
/scripts/create-php-config.sh
|
|
|
|
mkdir -p /run/php-fpm/
|
|
/usr/sbin/php-fpm -y /etc/php-fpm.conf
|
|
chown -R $user:$user /home/$user
|
|
# Do NOT `chmod -R 755` the docroot here. /home/$user is the customer's
|
|
# bind-mounted site directory; a recursive 755 on every start made every file
|
|
# (wp-config.php included) world-readable AND executable, and reverted any
|
|
# tighter permissions the customer had set. Apache (shared-httpd, or the
|
|
# bundled httpd) runs as `apache`, not the customer, so it only needs to
|
|
# traverse directories to serve static files. Normalise that and nothing else:
|
|
# open the docroot itself, and add o+x to directories that lack it. Regular
|
|
# files are never touched, so execute is never added and wp-config.php is
|
|
# never loosened.
|
|
chmod 755 /home/$user
|
|
find /home/$user -type d ! -perm -o=x -exec chmod o+x {} +
|
|
|
|
if [[ $environment == 'DEV' ]]; then
|
|
echo "Starting Dev Deployment (FPM-only mode)"
|
|
mkdir -p /home/$user/_db_backups
|
|
if ! command -v microdnf &> /dev/null; then
|
|
echo "microdnf not found, installing with dnf..."
|
|
dnf install -y microdnf && dnf clean all
|
|
fi
|
|
microdnf install -y MariaDB-server MariaDB-client memcached
|
|
sed -r -i 's/session.save_path="memcache:11211/session.save_path="localhost:11211/' /etc/php.ini
|
|
nohup mysqld -umysql &
|
|
if [ ! -f /home/$user/mysql_creds ]; then
|
|
echo "Give MySQL a chance to finish starting..."
|
|
sleep 10
|
|
mysql_user=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 13 ; echo '')
|
|
mysql_password=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 18 ; echo '')
|
|
mysql_db=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 6 ; echo '')
|
|
mysql -e "CREATE DATABASE devdb_"$mysql_db";"
|
|
mysql -e "CREATE USER '"$mysql_user"'@'localhost' IDENTIFIED BY '"$mysql_password"';"
|
|
mysql -e "GRANT ALL PRIVILEGES ON *.* TO '"$mysql_user"'@'localhost' WITH GRANT OPTION;"
|
|
mysql -e "FLUSH PRIVILEGES;"
|
|
echo "# User crontab for $user" > /home/$user/crontab
|
|
echo "*/15 * * * * /scripts/mysql-backup.sh $user devdb_$mysql_db" >> /home/$user/crontab
|
|
chown $user:$user /home/$user/crontab
|
|
echo "MySQL User: "$mysql_user > /home/$user/mysql_creds
|
|
echo "MySQL Password: "$mysql_password >> /home/$user/mysql_creds
|
|
echo "MySQL Database: devdb_"$mysql_db >> /home/$user/mysql_creds
|
|
cat /home/$user/mysql_creds
|
|
fi
|
|
/usr/bin/memcached -d -u $user
|
|
fi
|
|
|
|
if [[ $environment == 'PROD' ]]; then
|
|
if [ -f /etc/php.d/50-memcached.ini ]; then
|
|
sed -r -i 's/;session.save_path="localhost:11211/session.save_path="memcache:11211/' /etc/php.d/50-memcached.ini
|
|
fi
|
|
fi
|
|
|
|
# Set up user crontab
|
|
if [ ! -f /home/$user/crontab ]; then
|
|
echo "# User crontab for $user" > /home/$user/crontab
|
|
echo "# Add your cron jobs here" >> /home/$user/crontab
|
|
echo "# Example: */5 * * * * /home/$user/scripts/my-script.sh" >> /home/$user/crontab
|
|
chown $user:$user /home/$user/crontab
|
|
fi
|
|
|
|
# Load user crontab
|
|
crontab -u $user /home/$user/crontab
|
|
|
|
/usr/sbin/crond
|
|
|
|
# Tail PHP-FPM logs (becomes PID 1 process)
|
|
touch /home/$user/logs/php-fpm/error.log
|
|
tail -f /home/$user/logs/php-fpm/*
|
|
|
|
exit 0
|