Revert "Merge pull request #7878 from pixelfed/revert/docker-serversideup-v5-hardening"

This reverts commit e17c93a8b9, reversing
changes made to 1b9c1780b1.

.env.docker.example

@@ -25,7 +25,7 @@ MAX_PHOTO_SIZE="15000"
 MAX_CAPTION_LENGTH="500"
 MAX_ALBUM_LENGTH="4"
 MEDIA_TYPES="image/jpeg,image/jpg,image/png,image/gif" # Accepted upload mime types. 
-MODERN_MEDIA_TYPES="image/avif,image/jxl,image/webp" # webp/avif/jxl require the vips driver.
+MODERN_MEDIA_TYPES="image/heic,image/heif,image/avif,image/jxl,image/webp" # webp/avif/jxl require the vips driver.
 
 # Instance URL Configuration
 # IMPORTANT: Update these with your actual domain
@@ -33,6 +33,18 @@ APP_URL="https://yourdomain.com"
 APP_DOMAIN="yourdomain.com"
 ADMIN_DOMAIN="yourdomain.com"
 SESSION_DOMAIN=null # Keep as null unless required for sharing session cookies with subdomains like SSO
+
+# TRUSTED_PROXY (Required)
+# Read by the serversideup FrankenPHP image.
+#   cloudflare (default) - trust Cloudflare ranges (CF-Connecting-IP) + Docker networks
+#   sucuri               - trust Sucuri WAF ranges (X-Forwarded-For) + Docker networks
+#   local                - trust only private/Docker network ranges (X-Forwarded-For)
+#   off                  - disable trusted proxy handling
+TRUSTED_PROXY="local"
+
+# Trusted Proxies (Don't touch)
+# TRUST_PROXIES is read by Laravel's TrustProxies middleware. The serversideup
+# web server (Caddy) already validates the proxy before the request reaches PHP.
 TRUST_PROXIES="*"
 
 # Database Configuration

Dockerfile

@@ -239,6 +239,10 @@ RUN tee /usr/local/etc/php/conf.d/zz-pixelfed.ini > /dev/null <<'EOF'
 ffi.enable=true
 EOF
 
+# Caddy 2.11 caps request headers at 16KiB and returns 431 above that. Raise the
+# limit so large cookies don't break requests, while staying well under the old 1MB.
+COPY docker/frankenphp/caddyfile-global.d/max-header-size.caddyfile /etc/frankenphp/caddyfile-global.d/max-header-size.caddyfile
+
 COPY --from=ffmpeg /usr/local/ffmpeg/bin/ffmpeg /usr/bin/ffmpeg
 COPY --from=ffmpeg /usr/local/ffmpeg/bin/ffprobe /usr/bin/ffprobe
 COPY --from=ffmpeg /usr/local/ffmpeg/lib /usr/local/lib

bootstrap/app.php

@@ -69,6 +69,7 @@ return Application::configure(basePath: dirname(__DIR__))
         },
         channels: __DIR__.'/../routes/channels.php',
         commands: __DIR__.'/../routes/console.php',
+        health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware) {
         $middleware->use([

docker-compose.yml

@@ -62,6 +62,8 @@ services:
       PHP_POST_MAX_SIZE: "500M"
       PHP_UPLOAD_MAX_FILE_SIZE: "500M"
       PHP_OPCACHE_ENABLE: "1"
+      PHP_OPCACHE_VALIDATE_TIMESTAMPS: "0"
+      HEALTHCHECK_PATH: "/up"
       
       # Laravel Auto-run Configuration
       AUTORUN_ENABLED: "true"
@@ -72,12 +74,17 @@ services:
       AUTORUN_LARAVEL_ROUTE_CACHE: "true"
       AUTORUN_LARAVEL_VIEW_CACHE: "true"
       AUTORUN_LARAVEL_CONFIG_CACHE: "true"
-
     volumes:
       - ./storage:/var/www/html/storage
     depends_on:
       - db
       - redis
+    healthcheck:
+      test: ["CMD", "healthcheck-frankenphp"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
     networks:
       - pixelfed-network
 
@@ -91,6 +98,12 @@ services:
     env_file:
       - .env
     environment:
+      # PHP Configuration
+      PHP_POST_MAX_SIZE: "500M"
+      PHP_UPLOAD_MAX_FILE_SIZE: "500M"
+      PHP_OPCACHE_ENABLE: "1"
+      PHP_OPCACHE_VALIDATE_TIMESTAMPS: "0"
+      
       # Laravel Auto-run Configuration
       AUTORUN_ENABLED: "false"
       AUTORUN_LARAVEL_MIGRATION: "false"
@@ -100,16 +113,13 @@ services:
       AUTORUN_LARAVEL_ROUTE_CACHE: "false"
       AUTORUN_LARAVEL_VIEW_CACHE: "false"
       AUTORUN_LARAVEL_CONFIG_CACHE: "true"
-      PHP_POST_MAX_SIZE: "500M"
-      PHP_UPLOAD_MAX_FILE_SIZE: "500M"
-      PHP_OPCACHE_ENABLE: "1"
     volumes:
       - ./storage:/var/www/html/storage
     depends_on:
       - db
       - redis
     healthcheck:
-      test: ["CMD", "php", "artisan", "horizon:status"]
+      test: ["CMD", "healthcheck-horizon"]
       interval: 10s
       timeout: 5s
       retries: 3
@@ -127,6 +137,12 @@ services:
     env_file:
       - .env
     environment:
+      # PHP Configuration
+      PHP_POST_MAX_SIZE: "500M"
+      PHP_UPLOAD_MAX_FILE_SIZE: "500M"
+      PHP_OPCACHE_ENABLE: "1"
+      PHP_OPCACHE_VALIDATE_TIMESTAMPS: "0"
+      
       # Laravel Auto-run Configuration
       AUTORUN_ENABLED: "false"
       AUTORUN_LARAVEL_MIGRATION: "false"
@@ -136,9 +152,6 @@ services:
       AUTORUN_LARAVEL_ROUTE_CACHE: "false"
       AUTORUN_LARAVEL_VIEW_CACHE: "false"
       AUTORUN_LARAVEL_CONFIG_CACHE: "true"
-      PHP_POST_MAX_SIZE: "500M"
-      PHP_UPLOAD_MAX_FILE_SIZE: "500M"
-      PHP_OPCACHE_ENABLE: "1"
     volumes:
       - ./storage:/var/www/html/storage
     depends_on:
@@ -146,6 +159,9 @@ services:
       - redis
     healthcheck:
       test: ["CMD", "healthcheck-schedule"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
       start_period: 10s
     networks:
       - pixelfed-network

docker/frankenphp/caddyfile-global.d/max-header-size.caddyfile

@@ -0,0 +1,3 @@
+servers {
+	max_header_size 128KiB
+}