fix: address multi-dimensional review findings (nginx routing, hardening, CI) (#7)

* fix(nginx): stop blocking GLPI's legacy .php URLs (apirest.php, front/*, ajax/*)

The blanket `location ~ \.php$ { deny all; }` matched /apirest.php, /front/central.php,
/ajax/*.php etc. before try_files could route them through public/index.php — so the
REST API and the entire post-login UI returned 403 (the login page at / worked, which
is why the original smoke test missed it). Removed the block; GLPI 11 routes everything
through index.php and execution stays confined to it (the ^/index\.php$ location is the
only fastcgi pass). Verified: /apirest.php 403->400, /front/central.php 403->302.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

* fix(compose): decouple health from scheduler, cap_drop all services, socket-proxy

- app healthcheck is now php-fpm /ping only (was gated on a scheduler-touched cron
  heartbeat, so a dead scheduler made app unhealthy and blocked web from starting);
  dropped the now-unused glpi-heartbeat job.
- cap_drop: ALL on db, valkey, scheduler, backup, app-assets, socket-proxy (only app+web
  had it) with minimal re-adds; verified every service still starts healthy.
- ofelia no longer mounts the raw host docker socket (== host root): a least-privilege
  docker-socket-proxy (CONTAINERS+EXEC+POST only, healthchecked) sits in front; ofelia
  reaches it over the internal network. Pinned ofelia by digest.
- forward GLPI_DEFAULT_LANGUAGE + SESSION_COOKIE_SECURE; add scheduler TZ; fix the
  mem_limit/pm.max_children sizing comment.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

* fix(image): cache-marker hash, session-cookie toggle, pm sizing, version tracking

- entrypoint stores a SHA-256 of the cache DSN (not the cleartext DSN, which may carry a
  Redis password) and no longer logs the raw DSN; writes a session.cookie_secure drop-in
  from SESSION_COOKIE_SECURE so HTTPS deploys get the Secure flag.
- pm.max_children 25->10 to actually fit the 1.5g app cgroup; comment explains the math.
- docker-bake.hcl derives MINOR/MAJOR from GLPI_VERSION (no drift); dev target uses a
  neutral cache so it builds locally. Renovate now tracks the base images (PHP/Alpine)
  and the bake GLPI version too.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

* fix(ci+docs): manifest-aware GHCR cleanup, release make_latest, dedupe bots, dev override

- cleanup-packages: switch to dataaxiom/ghcr-cleanup-action — actions/delete-package-versions
  is not manifest-list aware and could delete a live image's per-arch children or
  cosign/SLSA referrers (the failure mode that bricked ghcr's phpbu-docker).
- release.yml: only the newest semver release moves the 'Latest' badge (make_latest gate).
- remove dependabot.yml — Renovate already manages actions + docker + versions (no dup PRs).
- compose.override.yml.example: GLPI_ENVIRONMENT_TYPE=development (GLPI has no APP_DEBUG),
  loopback-bind db/valkey; caddy overlay logging; .env redis-auth note; README/Makefile
  console + lint + backup-profile fixes.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

* ci(smoke-test): assert GLPI legacy .php entry points route (regression guard)

The serve check only hits / (the login page), which stayed 200 even while a blanket
nginx .php deny 403'd /apirest.php and /front/*.php. Add an explicit check that those
entry points are not forbidden so the nginx-routing regression can't recur.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

---------

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

Author: CybotTM

.env.example

@@ -32,9 +32,10 @@ DB_ROOT_PASSWORD=
 # -----------------------------------------------------------------------
 # Cache — Valkey (Linux Foundation Redis fork; speaks RESP, so redis:// works)
 # -----------------------------------------------------------------------
+# Put any auth in the DSN itself (redis://:pw@valkey:6379) AND add
+# --requirepass to the valkey command in compose.yml. The bundled valkey has
+# no password (reachable only on the internal network).
 GLPI_CACHE_DSN=redis://valkey:6379
-# Set only if you reconfigure the valkey service to require a password.
-REDIS_PASSWORD=
 
 # -----------------------------------------------------------------------
 # GLPI runtime

.github/dependabot.yml

@@ -30,15 +30,23 @@ jobs:
     permissions:
       packages: write
     steps:
-      - name: Delete old untagged versions
-        uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
+      # Manifest-list + referrer aware: actions/delete-package-versions is NOT,
+      # so it would happily delete a per-arch CHILD manifest (or a cosign sig /
+      # SLSA attestation referrer) of a LIVE tagged index once enough newer
+      # untagged versions exist — silently breaking multi-arch pulls and
+      # verification (the same failure mode that bricked ghcr's phpbu-docker).
+      # dataaxiom/ghcr-cleanup-action understands manifest lists: it keeps the
+      # children + referrers of every tagged image and only removes orphans.
+      - name: Delete orphaned / partial versions (manifest-aware)
+        uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # v1.2.2
         with:
-          package-name: ${{ env.PACKAGE_NAME }}
-          package-type: container
-          # Keep the 10 most recent untagged versions as a rollback margin.
-          min-versions-to-keep: 10
-          # Only ever delete untagged versions — released tags are immutable here.
-          delete-only-untagged-versions: true
+          packages: ${{ env.PACKAGE_NAME }}
+          delete-untagged: true          # orphaned untagged manifests
+          delete-partial-images: true    # incomplete multi-arch pushes
+          delete-ghost-images: true      # tags whose children were GC'd
+          keep-n-untagged: 10            # rollback margin
+          # Children + cosign/SLSA referrers of TAGGED images are retained
+          # automatically — tagged releases are never broken.
 
       - name: Summary
         env:
@@ -49,5 +57,5 @@ jobs:
             echo ""
             echo "- Package: \`${PACKAGE_NAME}\` (container)"
             echo "- Kept minimum: 10 untagged versions"
-            echo "- Deleted only untagged: true (tagged releases untouched)"
+            echo "- Manifest-aware prune (children + sig/attestation referrers of tagged images kept)"
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/cleanup-packages.yml

@@ -68,14 +68,26 @@ jobs:
           # rather than interpolating into the script body (sonarcloud
           # githubactions:S7630, shell injection).
           REF_NAME: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           # Defensive 'v' strip even though the tag filter already excludes it.
           VERSION="${REF_NAME#v}"
+          # Is this the newest semver tag in the repo? An out-of-order / backport
+          # release must NOT move the GH "Latest" badge (and ideally not the
+          # floating image tags) onto an older version.
+          NEWEST=$(gh api "repos/${REPO}/git/refs/tags" \
+                     --jq '.[].ref | ltrimstr("refs/tags/")' 2>/dev/null \
+                   | sed 's/^v//' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
+                   | sort -V | tail -1)
+          IS_NEWEST=true
+          [ -n "$NEWEST" ] && [ "$VERSION" != "$NEWEST" ] && IS_NEWEST=false
           {
             echo "version=$VERSION"
             echo "major=$(echo "$VERSION" | cut -d. -f1)"
             echo "minor=$(echo "$VERSION" | cut -d. -f1-2)"
+            echo "is_newest=$IS_NEWEST"
             echo "build_date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
             echo "git_sha=$(git rev-parse --short HEAD)"
           } >> "$GITHUB_OUTPUT"
@@ -141,6 +153,10 @@ jobs:
         with:
           # Auto-categorized from .github/release.yml; prepend the usage block.
           generate_release_notes: true
+          # Only the newest semver release gets the "Latest" badge — a backport
+          # release of an older line must not steal it (GH marks latest by
+          # creation time otherwise).
+          make_latest: ${{ steps.version.outputs.is_newest }}
           body: |
             ## Container image
 

.github/workflows/release.yml

@@ -131,6 +131,26 @@ jobs:
           docker compose logs --tail=200
           exit 1
 
+      - name: Assert GLPI routes legacy .php entry points (regression guard)
+        env:
+          PORT: '8080'
+        run: |
+          set -eu
+          # GLPI 11 routes /apirest.php, /front/*.php and /ajax/*.php through
+          # public/index.php. A blanket nginx `.php` deny would 403 these even
+          # though the login page at / still works (exactly the bug the serve
+          # check above cannot see). Assert none of them is forbidden.
+          rc=0
+          for p in /apirest.php /front/central.php /ajax/dashboard.php; do
+            code=$(curl -sS -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}${p}" || true)
+            echo "  ${p} -> HTTP ${code}"
+            if [ "$code" = "403" ] || [ "$code" = "000" ]; then
+              echo "::error::${p} returned ${code} — nginx is not routing a GLPI .php entry point"
+              rc=1
+            fi
+          done
+          [ "$rc" -eq 0 ] || { docker compose logs web --tail=50; exit 1; }
+
       - name: Assert app + web report healthy
         run: |
           set -eu

.github/workflows/smoke-test.yml

@@ -23,7 +23,9 @@
 #   GLPI_VERSION    — GLPI release (default 11.0.8 — keep in sync with .glpi-version)
 #   GLPI_SHA256     — sha256 of glpi-${GLPI_VERSION}.tgz (supply-chain pin; "" skips)
 
+# renovate: datasource=docker depName=php versioning=docker
 ARG PHP_VERSION=8.4
+# renovate: datasource=docker depName=alpine versioning=docker
 ARG ALPINE_VERSION=3.21
 
 # =====================================================================

Dockerfile

@@ -83,10 +83,10 @@ backup: ## Run a backup now (requires `make backup-up`; normally ofelia at 03:00
 	docker compose --profile backup exec -T backup phpbu --configuration=/config/backup.json
 
 backup-list: ## List backup archives
-	docker compose exec -T backup ls -lh /backups
+	docker compose --profile backup exec -T backup ls -lh /backups
 
 backup-verify: ## Sanity-check that last night's backup is on disk + non-zero
-	@docker compose exec -T backup sh -c '\
+	@docker compose --profile backup exec -T backup sh -c '\
 		latest=$$(ls -t /backups/db/*.sql.gz 2>/dev/null | head -1); \
 		if [ -z "$$latest" ]; then \
 			echo "✗ no DB backups in /backups/db"; exit 1; \
@@ -168,6 +168,9 @@ lint: ## Run hadolint + shellcheck + yamllint via Docker (no local install)
 		cytopia/yamllint:1 \
 		-d "{extends: default, rules: {line-length: disable, document-start: disable, truthy: {check-keys: false}, comments: {min-spaces-from-content: 1}}}" \
 		.github/workflows .hadolint.yaml compose.yml
+	@printf '\033[1;34m[lint]\033[0m actionlint .github/workflows\n'
+	docker run --rm -v $(CURDIR):/work -w /work \
+		rhysd/actionlint:latest -color
 
 # ────────────────────────────────────────────────────────────────────
 # Upgrade

Makefile

@@ -122,7 +122,7 @@ each on its own named volume.
 
 ```bash
 make logs                 # tail all services
-make console -- glpi:cache:clear      # run any bin/console command
+make console CMD="cache:clear"         # run any bin/console command
 make ps                   # status
 make down                 # stop (keep volumes)
 ```

README.md

@@ -6,55 +6,64 @@
 # Copy to compose.override.yml and `docker compose up -d` will merge it.
 #
 # Adds:
-#   - mailpit (SMTP sink + web UI on http://localhost:8025)
-#   - exposes db port on host:3306
-#   - exposes redis port on host:6379
-#   - flips APP_DEBUG=true for the app
-#   - opcache validate_timestamps=1 for hot-reload of code (only useful if
-#     you bind-mount source from the host, not for the default image-baked code)
+#   - mailpit (SMTP sink + web UI on http://127.0.0.1:8025); point GLPI at it
+#     from Setup > Notifications (host mailpit, port 1025) — GLPI configures SMTP
+#     in the UI, NOT via env.
+#   - adminer (DB UI on http://127.0.0.1:8081)
+#   - exposes db + valkey on LOOPBACK only for local inspection
+#   - GLPI_ENVIRONMENT_TYPE=development (GLPI's real debug switch — shows the
+#     debug toolbar + verbose errors; there is no Laravel APP_DEBUG in GLPI)
+#   - opcache validate_timestamps=1 for hot-reload (only useful if you bind-mount
+#     source over the image-baked code)
+#
+# All published ports are bound to 127.0.0.1 so a dev laptop on an untrusted
+# network never exposes the database / cache / mail UI off-host.
 
 services:
   app:
     environment:
-      APP_ENV: local
-      APP_DEBUG: "true"
-      MAIL_HOST: mailpit
-      MAIL_PORT: 1025
-      MAIL_ENCRYPTION: ""
-      MAIL_USERNAME: ""
-      MAIL_PASSWORD: ""
+      GLPI_ENVIRONMENT_TYPE: development
 
   db:
     ports:
-      - "3306:3306"
+      - "127.0.0.1:3306:3306"
 
   valkey:
-    # Heads-up: 6379 is the default Redis/Valkey port. If you already run a
-    # local Redis/Valkey on the host, `docker compose up` will fail with
-    # "bind: address already in use". Comment out the mapping below, or
-    # remap to a free host port (e.g. "16379:6379") if you don't need
-    # external access to this container's Valkey from the host.
     ports:
-      - "6379:6379"
+      - "127.0.0.1:6379:6379"
 
   mailpit:
     image: axllent/mailpit:latest
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
     ports:
-      - "8025:8025"   # web UI
-      - "1025:1025"   # SMTP (also reachable as mailpit:1025 from app)
+      - "127.0.0.1:8025:8025"   # web UI
+      - "127.0.0.1:1025:1025"   # SMTP (also reachable as mailpit:1025 from app)
     environment:
       MP_SMTP_AUTH_ACCEPT_ANY: "1"
       MP_SMTP_AUTH_ALLOW_INSECURE: "1"
+    security_opt:
+      - no-new-privileges:true
     networks:
       - glpi
 
   adminer:
     image: adminer:latest
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
     ports:
-      - "8081:8080"
+      - "127.0.0.1:8081:8080"
     environment:
       ADMINER_DEFAULT_SERVER: db
+    security_opt:
+      - no-new-privileges:true
     networks:
       - glpi