mastercontainer - limit access to php-fpm to localhost

[szaimen]

address part of #3172

[Zoey2936]

Suggested change

	grep -q ';listen.allowed_clients' /usr/local/etc/php-fpm.d/www.conf; \
	sed -i 's|;listen.allowed_clients.*|listen.allowed_clients = 127.0.0.1,::1|' /usr/local/etc/php-fpm.d/www.conf; \
	grep -q 'listen =' /usr/local/etc/php-fpm.d/www.conf; \
	sed -i 's|listen =.*|listen = /var/run/php.sock|' /usr/local/etc/php-fpm.d/www.conf; \

And change the Apache PHP handler to: SetHandler "proxy:unix:/var/run/php.sock"

[szaimen]

all right, lets do it like this then

[Zoey2936]

https://github.com/docker-library/php/blob/e9e47fd185d6b36e491c713811437b0c17944faa/8.2/alpine3.18/fpm/Dockerfile#L249

Suggested change

	grep -q ';listen.allowed_clients' /usr/local/etc/php-fpm.d/www.conf; \
	sed -i 's|;listen.allowed_clients.*|listen.allowed_clients = 127.0.0.1,::1|' /usr/local/etc/php-fpm.d/www.conf; \
	grep -q 'listen =' /usr/local/etc/php-fpm.d/www.conf; \
	sed -i 's|listen =.*|;listen = /var/run/php.sock # handled in zz-docker.conf|' /usr/local/etc/php-fpm.d/www.conf; \
	grep -q 'listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \
	sed -i 's|listen =.*|listen = /var/run/php.sock|' /usr/local/etc/php-fpm.d/zz-docker.conf; \

And change the Apache PHP handler to: SetHandler "proxy:unix:/var/run/php.sock"

[Zoey2936]

healthcheck also needs to check if /var/run/php.sock exists

[szaimen]

or we just actually limit it to 127.0.0.1:::1? would that be fine for you? Sounds like the easier approach...

[szaimen]

I see but perfomance is not critical for the mastercontainer... So I would honestly prefer an easier setup which in this case is limiting to localhost... Wdyt?

[Zoey2936]

I don't see why it is simpler to limit ips, instead of using a socket

[szaimen]

2 lines of code vs 4? also we need to adjust the healthcheck but yeah if you really want we can also use a socket

[Zoey2936]

I would use the socket

[szaimen]

@Zoey2936 lets switch to the socket in a follow-up.

I would welcome a PR :)

[Zoey2936]

also not needed, since php fpm is by default only exposed to 127.0.0.1 if I remember correctly

[Zoey2936]

/var/www/html # cat /usr/local/etc/php-fpm.d/www.conf | grep listen | grep -v ";"
listen = 127.0.0.1:9000

[szaimen]

/var/www/html # cat /usr/local/etc/php-fpm.d/www.conf | grep listen | grep -v ";"
listen = 127.0.0.1:9000

It is the same in the nextcloud container and there access from a different container is obiously possible so switching to a socket in the mastercontainer probably makes sense...

[szaimen]

This is now released with v7.2.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel