Skip to content

Sync #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Vooperino merged 9 commits into from
Feb 20, 2026
Merged

Sync #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
74769fd
Merge pull request #14 from voop-lv/main
Vooperino Jan 21, 2026
35b557e
LE Cert Script command changes and disabled aarch64 workflow
Vooperino Feb 17, 2026
b47ec15
Bump aquasecurity/trivy-action in /.github/workflows
dependabot[bot] Feb 18, 2026
33b51d0
Merge pull request #15 from voop-lv/dependabot/github_actions/dot-git…
Vooperino Feb 20, 2026
d46e64d
Added a path check for PHP running and applying the correct 777 permi…
Vooperino Feb 20, 2026
b0efef1
Reverting and troubleshooting
Vooperino Feb 20, 2026
f0dbd1e
Updated PHPFpm Restart Command
Vooperino Feb 20, 2026
3f79957
Im too tired
Vooperino Feb 20, 2026
a930807
Prep for sync
Vooperino Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
0 ...ub/workflows/build_containers_aarch64.yml → ...ed_workflows/build_containers_aarch64.yml
View file
Open in desktop
File renamed without changes.
2 changes: 1 addition & 1 deletion .github/workflows/build_container_template.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@

./build-images.sh $BSH_ARG
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.33.1
uses: aquasecurity/trivy-action@0.34.0
Comment thread Dismissed
with:
scan-type: 'image'
image-ref: '${{ inputs.image_name }}:${{ inputs.type }}-${{ inputs.image_tag }}'
Expand Down
7 changes: 6 additions & 1 deletion core_files/intcmd/applypermissions.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,12 @@ while true; do
for path in "${WWWDATA_PATHS[@]}"; do
if [[ -d "$path" ]]; then
echo "[INFO] Setting permissions for $path to $WWDATA_PERMISSION_CODE"
chmod -R "$WWDATA_PERMISSION_CODE" "$path"
FINAL_PERMCODE="$WWDATA_PERMISSION_CODE"
if [[ "$path" == "/run/php" ]]; then
FINAL_PERMCODE=0777
echo "[INFO] Special case for $path: setting permissions to $FINAL_PERMCODE"
Comment on lines +12 to +13

Copilot AI Feb 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Special-casing /run/php to always use 0777 recursively for FINAL_PERMCODE makes the PHP-FPM runtime directory and its contents world-writable. This allows any local user or compromised process on the host to connect to or tamper with PHP-FPM Unix sockets, bypassing web server authentication and IP/TLS protections and potentially gaining unauthorized access to PHP applications or data. Use a restrictive permission mask (e.g., 0750 on the directory and 0660 on sockets with a dedicated group) instead of 0777 for /run/php.

Suggested change
FINAL_PERMCODE=0777
echo "[INFO] Special case for $path: setting permissions to $FINAL_PERMCODE"
FINAL_PERMCODE=0750
echo "[INFO] Special case for $path: setting permissions to $FINAL_PERMCODE (restricted for PHP-FPM runtime)"

Copilot uses AI. Check for mistakes.
fi
chmod -R "$FINAL_PERMCODE" "$path"
if [[ $? -ne 0 ]]; then
echo "[ERROR] Failed to set permissions for $path"
else
Expand Down
16 changes: 16 additions & 0 deletions core_files/intcmd/letsencrypt/createLECert.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,15 +17,31 @@ if ! checkDir $sslDirPath; then
fi

WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot"
CLOUDFLARE_USED=false
if [ -f "/cloudflare-account.ini" ]; then
echo "Using CloudFlare API for DNS"
WEBROOT_OPTS="--dns-cloudflare --dns-cloudflare-credentials /cloudflare-account.ini"
unset CLOUDFLARE_USED
CLOUDFLARE_USED=true
fi

echo "Creating a cert for ${1}"
certbot certonly --config-dir $sslDirPath $WEBROOT_OPTS -n --agree-tos --register-unsafely-without-email -d ${1}
if [ $? -ne 0 ]; then
echo "[Failure] Unable to create certificate '${1}' due to an error"
if [ $CLOUDFLARE_USED = true ]; then

Copilot AI Feb 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The variable comparison is missing quotes around the variable. This should be if [ "$CLOUDFLARE_USED" = true ]; then for consistency with the same comparison in renewLEAllCert.sh line 43 and to prevent potential issues if the variable is empty or contains spaces.

Suggested change
if [ $CLOUDFLARE_USED = true ]; then
if [ "$CLOUDFLARE_USED" = true ]; then

Copilot uses AI. Check for mistakes.
echo "If you are using CloudFlare DNS, make sure your API key and email are correct in /cloudflare-account.ini! Using webroot method!"
unset WEBROOT_OPTS
WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot"
certbot certonly --config-dir $sslDirPath $WEBROOT_OPTS -n --agree-tos --register-unsafely-without-email -d ${1}
if [ $? -ne 0 ]; then
echo "[Failure] Unable to create certificate '${1}' using webroot method as well. Please check your configuration and try again."
exit 1
else
echo "Certificate created successfully using webroot method. Please check your configuration for CloudFlare DNS and try again if you want to use that method."
exit 0
fi
fi
exit 1
else
echo "End of script have a nice day! Enjoy you're new cert if it was created"
Expand Down
42 changes: 36 additions & 6 deletions core_files/intcmd/letsencrypt/renewLEAllCert.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ checkFile() {

certStuffRoot="/web/cert_webroot"
sslDirPath="/web/ssl"
sslLiveDirPath="/web/ssl/live"
logFile="/scripts/letsencrypt/letsencrypt-renew.log"

if ! checkDir $certStuffRoot; then
Expand All @@ -26,10 +27,39 @@ if ! checkFile $logFile; then
touch $logFile
fi

WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot"
if [ -f "/cloudflare-account.ini" ]; then
echo "Using CloudFlare API for DNS"
WEBROOT_OPTS="--dns-cloudflare --dns-cloudflare-credentials /cloudflare-account.ini"
fi
function renew() {
local certName="$1"
local WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot"
local CLOUDFLARE_USED=false
if [ -f "/cloudflare-account.ini" ]; then
echo "Using CloudFlare API for DNS"
WEBROOT_OPTS="--dns-cloudflare --dns-cloudflare-credentials /cloudflare-account.ini"
CLOUDFLARE_USED=true
fi
echo "Renewing certificate for $certName"
certbot renew --config-dir $sslDirPath $WEBROOT_OPTS --cert-name "$certName"
if [ $? -ne 0 ]; then
echo "Failed to renew certificate for $certName"
if [ "$CLOUDFLARE_USED" = true ]; then
echo "Please check your CloudFlare API credentials and permissions. Using webroot method as a fallback."
unset WEBROOT_OPTS
WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot"
certbot renew --config-dir $sslDirPath $WEBROOT_OPTS --cert-name "$certName"
if [ $? -ne 0 ]; then
echo "Failed to renew certificate for $certName using webroot method as well."
return 1
else
echo "Successfully renewed certificate for $certName using webroot method."
return 0
fi
fi
return 1
fi
}
Comment on lines +30 to +58

Copilot AI Feb 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The refactoring removed the logging of certbot output to the log file. Previously, certbot output was redirected to the log file with >> /scripts/letsencrypt/letsencrypt-renew.log. Now the renew function outputs directly to stdout/stderr without any file logging. The logFile variable is created but never used. Either remove the unused logFile variable (lines 13, 25-28) or restore logging functionality by redirecting certbot output to the log file.

Copilot uses AI. Check for mistakes.

certbot renew --config-dir $sslDirPath $WEBROOT_OPTS >> /scripts/letsencrypt/letsencrypt-renew.log
for certPath in "$sslLiveDirPath"/*; do
if [ -d "$certPath" ]; then
certName=$(basename "$certPath")
renew "$certName"
fi
done
Comment on lines +60 to +65

Copilot AI Feb 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The loop does not handle the case where the sslLiveDirPath does not exist or contains no subdirectories. If the directory doesn't exist or is empty, the glob pattern will fail silently without any feedback to the user. Consider adding a check before the loop to ensure the directory exists and contains certificates to renew, similar to how other directories are validated earlier in the script.

Copilot uses AI. Check for mistakes.
3 changes: 3 additions & 0 deletions core_files/intcmd/reloadPHPfpm.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,8 @@ function reloadService() {
echo "$service_name started successfully."
}

chmod 0777 -R /run/php

Copilot AI Feb 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The recursive chmod 0777 on /run/php combined with chown www-data:www-data makes the PHP-FPM runtime directory and its Unix sockets world-readable and world-writable. Any local user or compromised process on the host can then connect directly to the PHP-FPM socket, bypassing web server access controls (auth, IP restrictions, TLS) and interact with PHP applications as www-data, which can lead to privilege escalation and unauthorized data access. Restrict the directory and socket permissions to the minimum required (e.g., 0750/0660 with a dedicated group) instead of 0777.

Suggested change
chmod 0777 -R /run/php
chmod 0750 -R /run/php

Copilot uses AI. Check for mistakes.
chown www-data:www-data -R /run/php

reloadService "php7.4-fpm"
reloadService "php8.3-fpm"
Loading