shadowdaoandClaude Opus 5.5
14761597bb
entrypoint.sh and entrypoint-fpm.sh ran `chmod -R 755 /home/$user` on every container start. /home/$user is the bind-mounted customer site directory, so every file (wp-config.php included) became world-readable and executable, and any tighter permissions the customer set were reverted on each restart. The line dates from the initial commit (95b9397) and was copied into the FPM entrypoint (c781678); neither gives a reason. The legitimate need is that Apache (bundled httpd, or shared-httpd reading /mnt/users/...) runs as `apache`, not the customer, and must be able to traverse directories to serve static files. Keep the recursive chown. Replace the recursive chmod with: - chmod 755 on the docroot directory itself (matches entrypoint-litespeed.sh) - o+x on directories that lack it (find -type d ! -perm -o=x) Regular files are never touched: execute is never added, and wp-config.php or any other customer-restricted file is never loosened. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
107 lines
3.9 KiB
Bash
107 lines
3.9 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
if [ -z "$PHPVER" ]; then
|
|
PHPVER="83";
|
|
fi
|
|
|
|
if [ -z "$environment" ]; then
|
|
environment="PROD"
|
|
fi
|
|
|
|
adduser -u $uid $user
|
|
|
|
mkdir -p /home/$user/public_html
|
|
mkdir -p /home/$user/logs/{apache,php-fpm}
|
|
|
|
mv /var/log/httpd /var/log/httpd.bak
|
|
|
|
ln -s /home/$user/logs/apache /var/log/httpd
|
|
ln -s /home/$user/logs/php-fpm /var/log/php-fpm
|
|
|
|
rm -f /etc/httpd/conf.d/userdir.conf
|
|
docker_network=$(ip addr show |grep eth0 |grep inet |awk -F " " {'print $2'})
|
|
echo "RemoteIPInternalProxy $docker_network" >> /etc/httpd/conf.d/remoteip.conf
|
|
# /scripts/install-php$PHPVER.sh
|
|
|
|
source /scripts/detect-memory.sh
|
|
echo "Container memory: ${CONTAINER_MEMORY_MB}MB | PHP-FPM pm=${PHP_FPM_PM} max_children=${PHP_FPM_MAX_CHILDREN} | Apache workers=${APACHE_MAX_REQUEST_WORKERS}"
|
|
|
|
/scripts/create-vhost.sh
|
|
/scripts/create-php-config.sh
|
|
/scripts/create-apache-mpm-config.sh
|
|
|
|
if [ -f /etc/httpd/conf.d/ssl.conf ]; then
|
|
mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.bak
|
|
fi
|
|
|
|
/usr/sbin/httpd -k start
|
|
/usr/sbin/php-fpm -y /etc/php-fpm.conf
|
|
chown -R $user:$user /home/$user
|
|
# Do NOT `chmod -R 755` the docroot here. /home/$user is the customer's
|
|
# bind-mounted site directory; a recursive 755 on every start made every file
|
|
# (wp-config.php included) world-readable AND executable, and reverted any
|
|
# tighter permissions the customer had set. Apache (shared-httpd, or the
|
|
# bundled httpd) runs as `apache`, not the customer, so it only needs to
|
|
# traverse directories to serve static files. Normalise that and nothing else:
|
|
# open the docroot itself, and add o+x to directories that lack it. Regular
|
|
# files are never touched, so execute is never added and wp-config.php is
|
|
# never loosened.
|
|
chmod 755 /home/$user
|
|
find /home/$user -type d ! -perm -o=x -exec chmod o+x {} +
|
|
|
|
if [[ $environment == 'DEV' ]]; then
|
|
echo "Starting Dev Deployment"
|
|
mkdir -p /home/$user/_db_backups
|
|
# Ensure microdnf is available for installing MariaDB and memcached in DEV mode
|
|
if ! command -v microdnf &> /dev/null; then
|
|
echo "microdnf not found, installing with dnf..."
|
|
dnf install -y microdnf && dnf clean all
|
|
fi
|
|
microdnf install -y MariaDB-server MariaDB-client memcached
|
|
sed -r -i 's/session.save_path="memcache:11211/session.save_path="localhost:11211/' /etc/php.ini
|
|
nohup mysqld -umysql &
|
|
if [ ! -f /home/$user/mysql_creds ]; then
|
|
echo "Give MySQL a chance to finish starting..."
|
|
sleep 10
|
|
mysql_user=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 13 ; echo '')
|
|
mysql_password=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 18 ; echo '')
|
|
mysql_db=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 6 ; echo '')
|
|
mysql -e "CREATE DATABASE devdb_"$mysql_db";"
|
|
mysql -e "CREATE USER '"$mysql_user"'@'localhost' IDENTIFIED BY '"$mysql_password"';"
|
|
mysql -e "GRANT ALL PRIVILEGES ON *.* TO '"$mysql_user"'@'localhost' WITH GRANT OPTION;"
|
|
mysql -e "FLUSH PRIVILEGES;"
|
|
# Create user crontab with MySQL backup job
|
|
echo "# User crontab for $user" > /home/$user/crontab
|
|
echo "*/15 * * * * /scripts/mysql-backup.sh $user devdb_$mysql_db" >> /home/$user/crontab
|
|
chown $user:$user /home/$user/crontab
|
|
echo "MySQL User: "$mysql_user > /home/$user/mysql_creds
|
|
echo "MySQL Password: "$mysql_password >> /home/$user/mysql_creds
|
|
echo "MySQL Database: devdb_"$mysql_db >> /home/$user/mysql_creds
|
|
cat /home/$user/mysql_creds
|
|
|
|
fi
|
|
/usr/bin/memcached -d -u $user
|
|
|
|
fi
|
|
|
|
if [[ $environment == 'PROD' ]]; then
|
|
sed -r -i 's/;session.save_path="localhost:11211/session.save_path="memcache:11211/' /etc/php.d/50-memcached.ini
|
|
fi
|
|
|
|
# Set up user crontab
|
|
if [ ! -f /home/$user/crontab ]; then
|
|
echo "# User crontab for $user" > /home/$user/crontab
|
|
echo "# Add your cron jobs here" >> /home/$user/crontab
|
|
echo "# Example: */5 * * * * /home/$user/scripts/my-script.sh" >> /home/$user/crontab
|
|
chown $user:$user /home/$user/crontab
|
|
fi
|
|
|
|
# Load user crontab
|
|
crontab -u $user /home/$user/crontab
|
|
|
|
/usr/sbin/crond
|
|
tail -f /var/log/httpd/*
|
|
|
|
exit 0
|
|
|