Update configuration

Author: hel-platta-service

composer.lock

@@ -20,6 +20,7 @@ weight: 0
 is_admin: false
 permissions:
   - 'access content'
+  - 'access debug api'
   - 'restful get helfi_global_mobile_menu'
   - 'send javascript errors to sentry'
   - 'view helfi_announcements external entity'

conf/cmi/user.role.anonymous.yml

@@ -67,6 +67,14 @@ function environment_variable_isset(array $items) : bool {
   'all.preflight.php',
 ];
 
+$private_files_folder = getenv('DRUPAL_FILES_PRIVATE');
+
+// Make sure private files folder is outside webroot unless explicitly
+// configured so.
+if (!$private_files_folder && is_dir('/var/www/html/public/sites/default/files/private')) {
+  preflight_failed('sites/default/files/private folder found.');
+}
+
 // Allow additional custom checks to be added.
 // Create a 'all.preflight.php' file for checks that need to be run
 // on all environments and '{env}.preflight.php' for environment-specific

docker/openshift/preflight/preflight.php

@@ -110,7 +110,7 @@ function drupal_get_env(string|array $variables) : mixed {
 
 $settings['config_sync_directory'] = '../conf/cmi';
 $settings['file_public_path'] = getenv('DRUPAL_FILES_PUBLIC') ?: 'sites/default/files';
-$settings['file_private_path'] = getenv('DRUPAL_FILES_PRIVATE');
+$settings['file_private_path'] = getenv('DRUPAL_FILES_PRIVATE') ?: '/private_files';
 $settings['file_temp_path'] = getenv('DRUPAL_TMP_PATH') ?: '/tmp';
 
 if ($reverse_proxy_address = getenv('DRUPAL_REVERSE_PROXY_ADDRESS')) {