David Dyer
c7b836bcf2
- Created `admin-head.php` for consistent <head> markup across admin pages. - Created `admin-nav.php` for shared navigation bar, reducing duplication. - Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components. - Added security headers to `auth.php` and `index.php` for improved security. - Introduced `security-headers.php` to manage security headers across the application. - Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP). - Normalized file permissions during build process to prevent permission issues on deployment.
59 lines
2.0 KiB
YAML
59 lines
2.0 KiB
YAML
# The Old Fitz — production compose for the VPS.
|
|
#
|
|
# Expected layout, one folder per site:
|
|
# theoldfitz/
|
|
# docker-compose.yaml (this file)
|
|
# .env (optional, see PROXY_NETWORK below)
|
|
# www/ (contents of `npm run dist`)
|
|
# data/ (fitz.sqlite — never inside www/)
|
|
#
|
|
# First run: create data/ and `chown 33:33 data` (www-data in the image),
|
|
# then create the first admin with bin/create-user.php (see its header).
|
|
#
|
|
# The CasaOS dev host keeps its own copy of this file in the CasaOS app
|
|
# settings, with CasaOS paths and its x-casaos block.
|
|
|
|
name: the-old-fitz
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
# The reverse proxy's Docker network (NPM or Caddy). Set PROXY_NETWORK
|
|
# in .env if it isn't called "proxy".
|
|
name: ${PROXY_NETWORK:-proxy}
|
|
|
|
services:
|
|
the-old-fitz:
|
|
image: php:8.5-apache
|
|
container_name: the-old-fitz
|
|
restart: unless-stopped
|
|
# The image ships without a php.ini, so PHP falls back to dev-style
|
|
# defaults and shows errors (with server paths) to visitors. Activate
|
|
# the image's bundled production ini — display_errors off, errors to
|
|
# the log — and hide the PHP version header, then start Apache as usual.
|
|
# Paths are spelled out (the image's $PHP_INI_DIR) rather than using
|
|
# the variable, so no $-escaping is needed.
|
|
command:
|
|
- bash
|
|
- -c
|
|
- cp /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini && echo 'expose_php = Off' > /usr/local/etc/php/conf.d/zz-hardening.ini && exec apache2-foreground
|
|
networks:
|
|
- proxy
|
|
volumes:
|
|
- type: bind
|
|
source: ./www
|
|
target: /var/www/html
|
|
# Database lives outside the web root so Apache can't serve it.
|
|
- type: bind
|
|
source: ./data
|
|
target: /var/www/data
|
|
environment:
|
|
- TZ=America/Indiana/Indianapolis
|
|
- FITZ_DB_PATH=/var/www/data/fitz.sqlite
|
|
# Cap container logs so PHP's error log can't slowly fill the disk.
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: 10m
|
|
max-file: "3"
|