fix: address multi-dimensional review findings (nginx routing, hardening, CI)

[CybotTM]

Adversarial review (security, Dockerfile/image, entrypoint, compose, CI, importer) surfaced 35 findings; this fixes the actionable ones. Each fix was verified against a running stack / the exact CI linters.

Critical

• nginx blocked GLPI's legacy .php URLs. The blanket location ~ \.php$ { deny all; } 403'd /apirest.php (the API), /front/central.php (post-login landing) and /ajax/*.php — GLPI 11 routes those through index.php. The login page (/) worked, so the original smoke test missed it. Removed the block; execution stays confined to index.php. Verified: /apirest.php 403→400, /front/central.php 403→302.

High / Medium

• Health decoupled from the scheduler — app healthcheck is now php-fpm /ping only (was gated on a scheduler heartbeat, so a dead scheduler blocked web from starting).
• cap_drop: ALL on every service (was app+web only) with minimal re-adds — caught + fixed valkey/socket-proxy cap needs by testing.
• ofelia no longer holds the raw host docker socket (== host root): a least-privilege, healthchecked docker-socket-proxy (CONTAINERS+EXEC+POST only) sits in front; verified ofelia execs through it while /info stays 403.
• Manifest-aware GHCR cleanup — actions/delete-package-versions could delete a live image's per-arch children / cosign+SLSA referrers (the failure mode that bricked ghcr's phpbu-docker).
• bake derives MINOR/MAJOR from VERSION (no drift); Renovate now tracks base images + bake version; release make_latest gate; remove the Dependabot/Renovate overlap.

Low / cleanup

• cache marker stores a DSN hash (not a cleartext Redis password); SESSION_COOKIE_SECURE toggle (verified); pm.max_children sized to the cgroup; dev override uses GLPI env + loopback binds; caddy logging; GLPI_DEFAULT_LANGUAGE forwarded; README/Makefile/.env fixes.

Full stack verified healthy after all changes; hadolint/shellcheck/actionlint/yamllint/hardening-check/container-structure-test (20/20)/bats (42/42) all green. The importer findings were fixed separately in glpi-demo.

[github-actions]

Automated approval for maintainer PR

All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.

[github-actions]

Automated approval for maintainer PR

All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.

[gemini-code-assist]

Code Review

This pull request hardens the GLPI Docker setup by dropping capabilities, introducing a least-privilege Docker socket proxy for the scheduler, binding dev ports to loopback, and hashing cache credentials. However, several improvements are recommended: routing .php requests to FastCGI in Nginx to prevent raw source code exposure, configuring PHP session security via PHP-FPM pool settings instead of runtime file generation to support read-only filesystems, removing the invalid POST environment variable from the socket proxy, dropping capabilities for the app-assets service, and refining Renovate regex patterns to handle line endings and avoid overly generic matches.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

I am having trouble creating individual review comments. Click here to see my feedback.

config/nginx/conf.d/default.conf (72-73)

Removing the location ~ \.php$ { deny all; } block entirely introduces a security vulnerability. If any other .php file (such as a test file like info.php or a file added by a plugin) exists in the public/ directory, Nginx will serve its raw source code as static text because there is no FastCGI handler for general .php files. This can leak sensitive credentials or application logic.

To safely allow legacy .php URLs to be routed to index.php while preventing raw source code leakage, you should route all .php requests to FastCGI using try_files so they are executed rather than served as static text.

  location ~ \.php$ {
    try_files $uri /index.php$is_args$args;
    fastcgi_pass unix:/run/php-fpm/glpi.sock;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

rootfs/usr/local/bin/entrypoint.sh (252-258)

Writing to /usr/local/etc/php/conf.d/zz-session-secure.ini at runtime prevents running the container with a read-only root filesystem (a highly recommended security hardening practice).

Instead of dynamically generating a .ini file in the entrypoint, you can leverage php-fpm's built-in support for setting PHP INI values directly in the pool configuration (rootfs/usr/local/etc/php-fpm.d/zz-glpi.conf) using environment variables:

php_value[session.cookie_secure] = $SESSION_COOKIE_SECURE

This simplifies the entrypoint and makes the container fully compatible with read-only root filesystems.

compose.yml (361)

POST is not a valid environment variable for tecnativa/docker-socket-proxy. The proxy automatically allows the necessary POST requests for creating and starting exec instances when EXEC: "1" is enabled. Setting POST: "1" has no effect and can mislead maintainers into thinking it is a supported configuration. You can safely remove this line.

compose.yml (210-211)

The app-assets service is missing cap_drop: - ALL, which goes against the PR's stated goal of hardening all services with cap_drop: ALL. Since app-assets only copies static files and exits, it does not require any Linux capabilities. Adding cap_drop: - ALL will further harden this service.

    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

renovate.json (42-43)

Using a literal \\n in the regex pattern is sensitive to line endings and will fail to match if the file uses Windows-style CRLF (\r\n) line endings. Using \\r?\\n or \\s+ makes the regex robust against different line endings.

        "# renovate: datasource=docker depName=php versioning=docker\\r?\\nARG PHP_VERSION=(?<currentValue>\\S+)",
        "# renovate: datasource=docker depName=alpine versioning=docker\\r?\\nARG ALPINE_VERSION=(?<currentValue>\\S+)"

renovate.json (53)

The regex default = "(?<currentValue>\d+\.\d+\.\d+)" is too generic and will match any variable in docker-bake.hcl that has a semantic version as its default value. This can lead to incorrect updates if other variables are added in the future. Making the regex specific to the GLPI_VERSION variable prevents false positives.

        "variable \\"GLPI_VERSION\\" \\{\\s*default = \\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\\"

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud