Add support for Content-Security-Policy in images

This commit adds support for the "Content-Security-Policy" header in the
barrel images.

internal/wisski/ingredient/barrel/barrel/.dockerignore

@@ -2,7 +2,7 @@
 *
 
 # allow the following files:
-!conf/*
+!apache.d/*
 !scripts/*
 !ssh/*
 !php.ini.d/*

internal/wisski/ingredient/barrel/barrel/Dockerfile

@@ -76,7 +76,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
     docker-php-source delete
 
 # enable the apache rewrite mod
-RUN a2enmod rewrite
+RUN a2enmod rewrite headers
 
 
 # Install composer.
@@ -94,6 +94,8 @@ ADD php.ini.d/wisski.ini /usr/local/etc/php/conf.d/wisski.ini
 ARG OPCACHE_MODE=prod
 ADD php.ini.d/opcache-$OPCACHE_MODE.ini /usr/local/etc/php/conf.d/opcache.ini
 
+ARG CONTENT_SECURITY_POLICY=
+ENV CONTENT_SECURITY_POLICY=${CONTENT_SECURITY_POLICY}
 
 # Configure Apache.
 
@@ -102,8 +104,8 @@ RUN rm /etc/apache2/sites-available/*.conf && \
     rm /etc/apache2/sites-enabled/*.conf
 
 # Then add the WissKI site
-ADD conf/ports.conf /etc/apache2/ports.conf
-ADD conf/wisski.conf /etc/apache2/sites-available/wisski.conf
+ADD apache.d/conf/ports.conf /etc/apache2/ports.conf
+ADD apache.d/sites-available/wisski.conf /etc/apache2/sites-available/wisski.conf
 
 # And enable it
 RUN a2ensite wisski

internal/wisski/ingredient/barrel/barrel/apache.d/sites-available/wisski.conf

@@ -19,6 +19,11 @@
         Require all granted
     </Directory>
 
+    # Read the CONTENT_SECURITY_POLICY from the environment! 
+    PassEnv CONTENT_SECURITY_POLICY
+    Header set Content-Security-Policy %{CONTENT_SECURITY_POLICY}e "expr=-n osenv('CONTENT_SECURITY_POLICY')"
+
+    # Don't low to allow ignoring everything
     ErrorLog /dev/stderr
     CustomLog /dev/stdout combined
 </VirtualHost>

internal/wisski/ingredient/barrel/barrel/docker-compose.yml

@@ -7,6 +7,8 @@ services:
       args:
         BARREL_BASE_IMAGE: ${BARREL_BASE_IMAGE}
         OPCACHE_MODE: ${OPCACHE_MODE}
+        CONTENT_SECURITY_POLICY: ${CONTENT_SECURITY_POLICY}
+
     logging:
       driver: none
     

internal/wisski/ingredient/barrel/stack.go

@@ -31,8 +31,9 @@ func (barrel *Barrel) Stack() component.StackWithResources {
 			"DATA_PATH":   filepath.Join(barrel.FilesystemBase, "data"),
 			"RUNTIME_DIR": barrel.Malt.Config.Paths.RuntimeDir(),
 
-			"BARREL_BASE_IMAGE": barrel.GetDockerBaseImage(),
-			"OPCACHE_MODE":      barrel.OpCacheMode(),
+			"BARREL_BASE_IMAGE":       barrel.GetDockerBaseImage(),
+			"OPCACHE_MODE":            barrel.OpCacheMode(),
+			"CONTENT_SECURITY_POLICY": barrel.ContentSecurityPolicy,
 		},
 
 		MakeDirs: []string{"data", ".composer"},

internal/wisski/ingredient/barrel/system/system.go

@@ -32,6 +32,8 @@ func (smanager *SystemManager) Apply(ctx context.Context, progress io.Writer, sy
 		return err
 	}
 
+	// TODO: Apply Content-Security-Policy!
+
 	// and rebuild
 	return smanager.Dependencies.Barrel.Build(ctx, progress, start)
 }