mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-07 04:23:24 +09:00
242751e41b
* fix: harden Docker dev environment and add smoke tests Address Copilot review feedback from #6618: input validation on DB env vars in entrypoint, scoped AllowOverride, localhost-only DB port binding, security headers (Referrer-Policy, Permissions-Policy, X-Permitted-Cross-Domain-Policies), reduced php-fpm worker count, expose_php disabled, and .env excluded from git. Adds tests/tools/check_docker.sh — 29-point smoke test covering build, health, PHP extensions, config generation, cron, HTTP, security headers, and DB connectivity. * Update docker/entrypoint.sh Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address Copilot and TheWitness review feedback tests/tools/check_docker.sh: - shebang: #!/bin/bash -> #!/usr/bin/env bash (consistent with repo) - add GPL copyright header (2004-2026) - fix grep pattern: single-quoted '^${ext}$' never expanded variable; use double quotes so extension name is actually matched - add opcache to REQUIRED_EXTS (TheWitness) docker/entrypoint.sh: - shebang: #!/bin/bash -> #!/usr/bin/env bash docker/Dockerfile: - rrdtool comment: clarify that 1.9+ enables graph tooltip output via graphv, not merely "hover tooltips" (TheWitness) docker/apache.conf: - X-XSS-Protection: add TODO comment noting it is deprecated and that Cacti sets its own headers at the application layer (TheWitness) --------- Co-authored-by: TheWitness <thewitness@cacti.net> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
31 lines
1.1 KiB
ApacheConf
31 lines
1.1 KiB
ApacheConf
<VirtualHost *:80>
|
|
ServerAdmin webmaster@localhost
|
|
DocumentRoot /var/www/html
|
|
|
|
<Directory /var/www/html/cacti>
|
|
Options -Indexes +FollowSymLinks
|
|
AllowOverride FileInfo Options=FollowSymLinks
|
|
Require all granted
|
|
|
|
# Proxy PHP requests to php-fpm
|
|
<FilesMatch \.php$>
|
|
SetHandler "proxy:fcgi://127.0.0.1:9000"
|
|
</FilesMatch>
|
|
</Directory>
|
|
|
|
# Logging
|
|
ErrorLog ${APACHE_LOG_DIR}/error.log
|
|
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
|
|
|
# Security headers
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set X-Frame-Options "SAMEORIGIN"
|
|
# X-XSS-Protection is deprecated; kept for legacy browsers only.
|
|
# Cacti sets its own CSP headers at the application layer.
|
|
# TODO: remove once minimum-browser support allows dropping it.
|
|
Header always set X-XSS-Protection "1; mode=block"
|
|
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
|
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
|
|
Header always set X-Permitted-Cross-Domain-Policies "none"
|
|
</VirtualHost>
|