mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-30 16:47:14 +09:00
Thomas Vincent
41780277d3
* fix(docker): restrict the dev stack to localhost and make the poller run The web port bound to every interface, named volumes hid the shipped .htaccess denies, and the cron job could neither find php nor write to PID 1's output, so the poller never ran. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(docker): keep harnesses polling and restore the developer's config.php check_docker.sh deleted an existing include/config.php on exit, health polling aborted under pipefail before the container reported, the MariaDB wait had no bound, and the BSD mktemp template left its Xs literal. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs(changelog): add fragment for #8453 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(e2e): move the pointer off the Deepness multiselect button Deepness sets a zero body margin, so the unhovered #ms-button sits at the viewport origin and headless Chromium on Linux intermittently applies :hover to it. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: pull pinned integration database from authenticated mirror Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
54 lines
2.2 KiB
ApacheConf
54 lines
2.2 KiB
ApacheConf
<VirtualHost *:80>
|
|
ServerAdmin webmaster@localhost
|
|
DocumentRoot /var/www/html
|
|
|
|
<Directory /var/www/html/cacti>
|
|
Options -Indexes +FollowSymLinks
|
|
# Cacti ships .htaccess deny rules in bin/, cli/, contrib/, log/, mibs/,
|
|
# rra/, scripts/, tests/ and cache/ subdirectories (Require all denied /
|
|
# Order,Deny) to block direct web access to logs and non-executed files.
|
|
# FileInfo/Options alone does not cover the AuthConfig/Limit override
|
|
# types those rules need, which silently disables them
|
|
# (GHSA-fxfg-j995-j69j); AllowOverride All lets them apply.
|
|
AllowOverride All
|
|
Require all granted
|
|
|
|
# The source tree is bind mounted, so .env, .git and other dotfiles
|
|
# sit in the web root.
|
|
<FilesMatch "^\.">
|
|
Require all denied
|
|
</FilesMatch>
|
|
|
|
# Proxy PHP requests to php-fpm
|
|
<FilesMatch \.php$>
|
|
SetHandler "proxy:fcgi://127.0.0.1:9000"
|
|
</FilesMatch>
|
|
</Directory>
|
|
|
|
# docker-compose.yml mounts empty named volumes over cache/, rra/ and log/,
|
|
# hiding the .htaccess files shipped there, so repeat the denies here where
|
|
# no mount can mask them. DirectoryMatch is merged after .htaccess files.
|
|
<DirectoryMatch "^/var/www/html/cacti/(bin|cache|cli|contrib|log|mibs|rra|scripts|tests)(/|$)">
|
|
Require all denied
|
|
</DirectoryMatch>
|
|
|
|
<DirectoryMatch "^/var/www/html/cacti/(.*/)?\.">
|
|
Require all denied
|
|
</DirectoryMatch>
|
|
|
|
# Logging
|
|
ErrorLog ${APACHE_LOG_DIR}/error.log
|
|
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
|
|
|
# Security headers
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set X-Frame-Options "SAMEORIGIN"
|
|
# X-XSS-Protection is deprecated; kept for legacy browsers only.
|
|
# Cacti sets its own CSP headers at the application layer.
|
|
# TODO: remove once minimum-browser support allows dropping it.
|
|
Header always set X-XSS-Protection "1; mode=block"
|
|
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
|
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
|
|
Header always set X-Permitted-Cross-Domain-Policies "none"
|
|
</VirtualHost>
|