diff --git a/cmd/provision.go b/cmd/provision.go
index 31806f3..2744efa 100644
--- a/cmd/provision.go
+++ b/cmd/provision.go
@@ -13,9 +13,10 @@ import (
var Provision wisski_distillery.Command = pv{}
type pv struct {
- PHPVersion string `short:"p" long:"php" description:"specific php version to use for instance. Should be one of '8.0', '8.1'."`
- OPCacheDevelopment bool `short:"o" long:"opcache-devel" description:"Include opcache development configuration"`
- Positionals struct {
+ PHPVersion string `short:"p" long:"php" description:"specific php version to use for instance. Should be one of '8.0', '8.1'."`
+ OPCacheDevelopment bool `short:"o" long:"opcache-devel" description:"Include opcache development configuration"`
+ ContentSecurityPolicy string `short:"c" long:"content-security-policy" description:"Setup ContentSecurityPolicy"`
+ Positionals struct {
Slug string `positional-arg-name:"slug" required:"1-1" description:"slug of instance to create"`
} `positional-args:"true"`
}
@@ -41,8 +42,9 @@ func (p pv) Run(context wisski_distillery.Context) error {
instance, err := context.Environment.Provision().Provision(context.Stderr, context.Context, provision.Flags{
Slug: p.Positionals.Slug,
System: models.System{
- PHP: p.PHPVersion,
- OpCacheDevelopment: p.OPCacheDevelopment,
+ PHP: p.PHPVersion,
+ OpCacheDevelopment: p.OPCacheDevelopment,
+ ContentSecurityPolicy: p.ContentSecurityPolicy,
},
})
if err != nil {
diff --git a/cmd/rebuild.go b/cmd/rebuild.go
index f97ce72..9c4cf39 100644
--- a/cmd/rebuild.go
+++ b/cmd/rebuild.go
@@ -18,9 +18,11 @@ var Rebuild wisski_distillery.Command = rebuild{}
type rebuild struct {
Parallel int `short:"a" long:"parallel" description:"run on (at most) this many instances in parallel. 0 for no limit." default:"1"`
- PHPVersion string `short:"p" long:"php" description:"update to specific php version to use for instance. Should be one of '8.0', '8.1'."`
- OPCacheDevelopment bool `short:"o" long:"opcache-devel" description:"Include opcache development configuration"`
- Positionals struct {
+ PHPVersion string `short:"p" long:"php" description:"update to specific php version to use for instance. Should be one of '8.0', '8.1'."`
+ OPCacheDevelopment bool `short:"o" long:"opcache-devel" description:"Include opcache development configuration"`
+ ContentSecurityPolicy string `short:"c" long:"content-security-policy" description:"Setup ContentSecurityPolicy"`
+
+ Positionals struct {
Slug []string `positional-arg-name:"SLUG" required:"0" description:"slug of instance or instances to run rebuild"`
} `positional-args:"true"`
}
@@ -56,6 +58,7 @@ func (rb rebuild) Run(context wisski_distillery.Context) (err error) {
return instance.SystemManager().Apply(context.Context, writer, models.System{
PHP: rb.PHPVersion,
OpCacheDevelopment: rb.OPCacheDevelopment,
+ ContentSecurityPolicy: rb.ContentSecurityPolicy,
}, true)
}, wissKIs, status.SmartMessage(func(item *wisski.WissKI) string {
return fmt.Sprintf("rebuild %q", item.Slug)
diff --git a/internal/cli/cli_notices.go b/internal/cli/cli_notices.go
index 082c426..03bef73 100755
--- a/internal/cli/cli_notices.go
+++ b/internal/cli/cli_notices.go
@@ -1,7 +1,7 @@
package cli
// ===========================================================================================================
-// This file was generated automatically at 13-07-2023 13:31:03 using gogenlicense.
+// This file was generated automatically at 13-07-2023 21:49:29 using gogenlicense.
// Do not edit manually, as changes may be overwritten.
// ===========================================================================================================
@@ -4913,7 +4913,7 @@ package cli
// # Generation
//
// This variable and the associated documentation have been automatically generated using the 'gogenlicense' tool.
-// It was last updated at 13-07-2023 13:31:03.
+// It was last updated at 13-07-2023 21:49:29.
var LegalNotices string
func init() {
diff --git a/internal/dis/component/server/admin/html/instance.html b/internal/dis/component/server/admin/html/instance.html
index e0028aa..68c03f3 100644
--- a/internal/dis/component/server/admin/html/instance.html
+++ b/internal/dis/component/server/admin/html/instance.html
@@ -120,6 +120,14 @@
{{ .Instance.System.OpCacheDevelopment }}
+
+
+ Content Security Policy
+
+
+ {{ .Instance.System.ContentSecurityPolicy }}
+
+
@@ -143,7 +151,7 @@
Directory
- {{ .Instance.FilesystemBase }}
+ {{ .Instance.FilesystemBase }}
@@ -351,7 +359,7 @@
{{ $slug := .Instance.Slug }}
{{ $csrf := .CSRF }}
{{ range $index, $user := .Info.Users }}
-
+
{{ $user.UID }}
diff --git a/internal/dis/component/server/admin/html/instance_provision.html b/internal/dis/component/server/admin/html/instance_provision.html
index 2d7ccb7..6ced76f 100644
--- a/internal/dis/component/server/admin/html/instance_provision.html
+++ b/internal/dis/component/server/admin/html/instance_provision.html
@@ -5,7 +5,7 @@
Slug
-
@@ -24,6 +24,10 @@
+ Content Security Policy
+
Profile
@@ -35,4 +39,9 @@
+ {{ range .ContentSecurityPolicies }}
+
+ {{ end }}
+
\ No newline at end of file
diff --git a/internal/dis/component/server/admin/html/instance_rebuild.html b/internal/dis/component/server/admin/html/instance_rebuild.html
index 1e9875f..f8ed7e7 100644
--- a/internal/dis/component/server/admin/html/instance_rebuild.html
+++ b/internal/dis/component/server/admin/html/instance_rebuild.html
@@ -1,11 +1,11 @@
-
+
+ Content Security Policy
+
Profile
@@ -36,4 +40,10 @@
+ {{ range .ContentSecurityPolicies }}
+
+ {{ end }}
+
\ No newline at end of file
diff --git a/internal/dis/component/server/admin/html/users.html b/internal/dis/component/server/admin/html/users.html
index e51ca7b..91389fc 100644
--- a/internal/dis/component/server/admin/html/users.html
+++ b/internal/dis/component/server/admin/html/users.html
@@ -37,7 +37,7 @@
{{ $csrf := .CSRF }}
{{ range .Users }}
-
+
{{ .User.User }}
diff --git a/internal/dis/component/server/admin/instance_provision.go b/internal/dis/component/server/admin/instance_provision.go
index e6a8a1a..fd2aa31 100644
--- a/internal/dis/component/server/admin/instance_provision.go
+++ b/internal/dis/component/server/admin/instance_provision.go
@@ -27,12 +27,14 @@ type instanceProvisionContext struct {
}
type systemParams struct {
- PHPVersions []string
- DefaultPHPVersion string
+ PHPVersions []string
+ ContentSecurityPolicies []string
+ DefaultPHPVersion string
}
func newSystemParams() (sp systemParams) {
sp.PHPVersions = models.KnownPHPVersions()
+ sp.ContentSecurityPolicies = models.ContentSecurityPolicyExamples()
sp.DefaultPHPVersion = models.DefaultPHPVersion
return sp
}
diff --git a/internal/dis/component/server/assets/assets_dist.go b/internal/dis/component/server/assets/assets_dist.go
index 25e246a..0f462fd 100644
--- a/internal/dis/component/server/assets/assets_dist.go
+++ b/internal/dis/component/server/assets/assets_dist.go
@@ -25,17 +25,17 @@ var AssetsUser = Assets{
// AssetsAdmin contains assets for the 'Admin' entrypoint.
var AssetsAdmin = Assets{
Scripts: ``,
- Styles: `Note "
+ return "Note "
case 0:
- return "Info "
+ return "Info "
case 1:
- return "Warning "
+ return "Warning "
case 2:
- return "Error "
+ return "Error "
}
return template.HTML(strconv.Itoa(req.Severity))
}
diff --git a/internal/wisski/ingredient/barrel/barrel/.dockerignore b/internal/wisski/ingredient/barrel/barrel/.dockerignore
index 6d594ed..dabff25 100644
--- a/internal/wisski/ingredient/barrel/barrel/.dockerignore
+++ b/internal/wisski/ingredient/barrel/barrel/.dockerignore
@@ -2,7 +2,7 @@
*
# allow the following files:
-!conf/*
+!apache.d/*
!scripts/*
!ssh/*
!php.ini.d/*
\ No newline at end of file
diff --git a/internal/wisski/ingredient/barrel/barrel/Dockerfile b/internal/wisski/ingredient/barrel/barrel/Dockerfile
index 30dec67..49806c2 100644
--- a/internal/wisski/ingredient/barrel/barrel/Dockerfile
+++ b/internal/wisski/ingredient/barrel/barrel/Dockerfile
@@ -76,7 +76,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
docker-php-source delete
# enable the apache rewrite mod
-RUN a2enmod rewrite
+RUN a2enmod rewrite headers
# Install composer.
@@ -94,6 +94,8 @@ ADD php.ini.d/wisski.ini /usr/local/etc/php/conf.d/wisski.ini
ARG OPCACHE_MODE=prod
ADD php.ini.d/opcache-$OPCACHE_MODE.ini /usr/local/etc/php/conf.d/opcache.ini
+ARG CONTENT_SECURITY_POLICY=
+ENV CONTENT_SECURITY_POLICY=${CONTENT_SECURITY_POLICY}
# Configure Apache.
@@ -102,8 +104,8 @@ RUN rm /etc/apache2/sites-available/*.conf && \
rm /etc/apache2/sites-enabled/*.conf
# Then add the WissKI site
-ADD conf/ports.conf /etc/apache2/ports.conf
-ADD conf/wisski.conf /etc/apache2/sites-available/wisski.conf
+ADD apache.d/conf/ports.conf /etc/apache2/ports.conf
+ADD apache.d/sites-available/wisski.conf /etc/apache2/sites-available/wisski.conf
# And enable it
RUN a2ensite wisski
diff --git a/internal/wisski/ingredient/barrel/barrel/conf/ports.conf b/internal/wisski/ingredient/barrel/barrel/apache.d/conf/ports.conf
similarity index 100%
rename from internal/wisski/ingredient/barrel/barrel/conf/ports.conf
rename to internal/wisski/ingredient/barrel/barrel/apache.d/conf/ports.conf
diff --git a/internal/wisski/ingredient/barrel/barrel/conf/wisski.conf b/internal/wisski/ingredient/barrel/barrel/apache.d/sites-available/wisski.conf
similarity index 74%
rename from internal/wisski/ingredient/barrel/barrel/conf/wisski.conf
rename to internal/wisski/ingredient/barrel/barrel/apache.d/sites-available/wisski.conf
index 05ee47e..07a8439 100644
--- a/internal/wisski/ingredient/barrel/barrel/conf/wisski.conf
+++ b/internal/wisski/ingredient/barrel/barrel/apache.d/sites-available/wisski.conf
@@ -19,6 +19,11 @@
Require all granted
+ # Read the CONTENT_SECURITY_POLICY from the environment!
+ PassEnv CONTENT_SECURITY_POLICY
+ Header set Content-Security-Policy %{CONTENT_SECURITY_POLICY}e "expr=-n osenv('CONTENT_SECURITY_POLICY')"
+
+ # Don't low to allow ignoring everything
ErrorLog /dev/stderr
CustomLog /dev/stdout combined
diff --git a/internal/wisski/ingredient/barrel/barrel/docker-compose.yml b/internal/wisski/ingredient/barrel/barrel/docker-compose.yml
index 6c3ade8..5b4f752 100644
--- a/internal/wisski/ingredient/barrel/barrel/docker-compose.yml
+++ b/internal/wisski/ingredient/barrel/barrel/docker-compose.yml
@@ -7,6 +7,8 @@ services:
args:
BARREL_BASE_IMAGE: ${BARREL_BASE_IMAGE}
OPCACHE_MODE: ${OPCACHE_MODE}
+ CONTENT_SECURITY_POLICY: ${CONTENT_SECURITY_POLICY}
+
logging:
driver: none
diff --git a/internal/wisski/ingredient/barrel/stack.go b/internal/wisski/ingredient/barrel/stack.go
index 15f79c8..038d530 100644
--- a/internal/wisski/ingredient/barrel/stack.go
+++ b/internal/wisski/ingredient/barrel/stack.go
@@ -31,8 +31,9 @@ func (barrel *Barrel) Stack() component.StackWithResources {
"DATA_PATH": filepath.Join(barrel.FilesystemBase, "data"),
"RUNTIME_DIR": barrel.Malt.Config.Paths.RuntimeDir(),
- "BARREL_BASE_IMAGE": barrel.GetDockerBaseImage(),
- "OPCACHE_MODE": barrel.OpCacheMode(),
+ "BARREL_BASE_IMAGE": barrel.GetDockerBaseImage(),
+ "OPCACHE_MODE": barrel.OpCacheMode(),
+ "CONTENT_SECURITY_POLICY": barrel.ContentSecurityPolicy,
},
MakeDirs: []string{"data", ".composer"},
diff --git a/internal/wisski/ingredient/barrel/system/system.go b/internal/wisski/ingredient/barrel/system/system.go
index 8fbed20..f9379fe 100644
--- a/internal/wisski/ingredient/barrel/system/system.go
+++ b/internal/wisski/ingredient/barrel/system/system.go
@@ -32,6 +32,8 @@ func (smanager *SystemManager) Apply(ctx context.Context, progress io.Writer, sy
return err
}
+ // TODO: Apply Content-Security-Policy!
+
// and rebuild
return smanager.Dependencies.Barrel.Build(ctx, progress, start)
}