Thanakorn
ae98dcdcdd
- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and app internals; security headers, HSTS over TLS, optional HTTPS redirect - uploads served through app/file.php to signed-in users only - Apache/PHP hardening config for the container (ServerTokens, expose_php) - least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php; SMTP passwords re-encrypted with a random IV (secret_box.php) - Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets - escape notification text; CLI guards on build scripts; no fixed demo password
24 lines
1.0 KiB
Docker
24 lines
1.0 KiB
Docker
FROM php:8.3-apache
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libzip-dev libicu-dev libonig-dev default-mysql-client gettext-base \
|
|
libpng-dev libjpeg-dev libfreetype6-dev \
|
|
&& docker-php-ext-configure gd --with-jpeg --with-freetype \
|
|
&& docker-php-ext-install pdo_mysql mysqli mbstring gd zip intl sockets exif opcache \
|
|
&& a2enmod rewrite headers \
|
|
&& apt-get clean && rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY docker/php/opcache.ini /usr/local/etc/php/conf.d/opcache-recommended.ini
|
|
COPY docker/php/security.ini /usr/local/etc/php/conf.d/zz-security.ini
|
|
COPY docker/php/apache-wms.conf /etc/apache2/conf-available/wms.conf
|
|
RUN a2enconf wms
|
|
COPY docker/php/entrypoint.sh /usr/local/bin/docker-entrypoint-wms.sh
|
|
COPY docker/php/config.php.template /usr/local/etc/wms/config.php.template
|
|
COPY docker/php/provision.php /usr/local/etc/wms/provision.php
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint-wms.sh
|
|
|
|
WORKDIR /var/www/html/wms-app
|
|
|
|
ENTRYPOINT ["docker-entrypoint-wms.sh"]
|
|
CMD ["apache2-foreground"]
|