Refactor configuration handling: implement dynamic loading of config and cache paths for improved security and flexibility in Docker environments

docker-compose.yaml

@@ -5,10 +5,13 @@
 #     docker-compose.yaml   (this file)
 #     .env                  (optional, see PROXY_NETWORK below)
 #     www/                  (contents of `npm run dist`)
-#     data/                 (fitz.sqlite — never inside www/)
+#     config/config.php     (live secrets — never inside www/, never in dist/)
+#     data/                 (fitz.sqlite + cache/ — never inside www/)
 #
-# First run: create data/ and `chown 33:33 data` (www-data in the image),
-# then create the first admin with bin/create-user.php (see its header).
+# First run: create data/ and `chown 33:33 data` (www-data in the image).
+# Copy config.example.php to config/config.php, fill it in, and make it
+# readable by www-data (`chown root:33` + `chmod 640`). Then create the
+# first admin with bin/create-user.php (see its header).
 #
 # The CasaOS dev host keeps its own copy of this file in the CasaOS app
 # settings, with CasaOS paths and its x-casaos block.
@@ -43,13 +46,23 @@ services:
       - type: bind
         source: ./www
         target: /var/www/html
-      # Database lives outside the web root so Apache can't serve it.
+      # Database and cache live outside the web root so Apache can't serve
+      # them and deploys to www/ never touch them.
       - type: bind
         source: ./data
         target: /var/www/data
+      # Config is mounted as a directory, not a single file: a single-file
+      # bind mount pins the inode, so an editor that saves by replacing the
+      # file leaves the container reading the old copy until a restart.
+      - type: bind
+        source: ./config
+        target: /var/www/config
+        read_only: true
     environment:
       - TZ=America/Indiana/Indianapolis
       - FITZ_DB_PATH=/var/www/data/fitz.sqlite
+      - FITZ_CACHE_DIR=/var/www/data/cache
+      - FITZ_CONFIG_PATH=/var/www/config/config.php
     # Cap container logs so PHP's error log can't slowly fill the disk.
     logging:
       driver: json-file