From 9eab456c3b1e4b91ef5077f03bc8e970b9fc8aa9 Mon Sep 17 00:00:00 2001 From: Ashley Date: Thu, 22 Oct 2026 02:03:28 +1030 Subject: [PATCH] Revert "Merge pull request #7878 from pixelfed/revert/docker-serversideup-v5-hardening" This reverts commit e17c93a8b95f7ce670159c4e90738217aaadf87c, reversing changes made to 1b9c1780b1c8ecd643dac57a6ed86e5463100a0a. --- .env.docker.example | 14 +++++++- Dockerfile | 4 +++ bootstrap/app.php | 1 + docker-compose.yml | 32 ++++++++++++++----- .../max-header-size.caddyfile | 3 ++ 5 files changed, 45 insertions(+), 9 deletions(-) create mode 100644 docker/frankenphp/caddyfile-global.d/max-header-size.caddyfile diff --git a/.env.docker.example b/.env.docker.example index 75b14692e..bbdf6492e 100644 --- a/.env.docker.example +++ b/.env.docker.example @@ -25,7 +25,7 @@ MAX_PHOTO_SIZE="15000" MAX_CAPTION_LENGTH="500" MAX_ALBUM_LENGTH="4" MEDIA_TYPES="image/jpeg,image/jpg,image/png,image/gif" # Accepted upload mime types. -MODERN_MEDIA_TYPES="image/avif,image/jxl,image/webp" # webp/avif/jxl require the vips driver. +MODERN_MEDIA_TYPES="image/heic,image/heif,image/avif,image/jxl,image/webp" # webp/avif/jxl require the vips driver. # Instance URL Configuration # IMPORTANT: Update these with your actual domain @@ -33,6 +33,18 @@ APP_URL="https://yourdomain.com" APP_DOMAIN="yourdomain.com" ADMIN_DOMAIN="yourdomain.com" SESSION_DOMAIN=null # Keep as null unless required for sharing session cookies with subdomains like SSO + +# TRUSTED_PROXY (Required) +# Read by the serversideup FrankenPHP image. +# cloudflare (default) - trust Cloudflare ranges (CF-Connecting-IP) + Docker networks +# sucuri - trust Sucuri WAF ranges (X-Forwarded-For) + Docker networks +# local - trust only private/Docker network ranges (X-Forwarded-For) +# off - disable trusted proxy handling +TRUSTED_PROXY="local" + +# Trusted Proxies (Don't touch) +# TRUST_PROXIES is read by Laravel's TrustProxies middleware. The serversideup +# web server (Caddy) already validates the proxy before the request reaches PHP. TRUST_PROXIES="*" # Database Configuration diff --git a/Dockerfile b/Dockerfile index 37803ea18..86212c847 100644 --- a/Dockerfile +++ b/Dockerfile @@ -239,6 +239,10 @@ RUN tee /usr/local/etc/php/conf.d/zz-pixelfed.ini > /dev/null <<'EOF' ffi.enable=true EOF +# Caddy 2.11 caps request headers at 16KiB and returns 431 above that. Raise the +# limit so large cookies don't break requests, while staying well under the old 1MB. +COPY docker/frankenphp/caddyfile-global.d/max-header-size.caddyfile /etc/frankenphp/caddyfile-global.d/max-header-size.caddyfile + COPY --from=ffmpeg /usr/local/ffmpeg/bin/ffmpeg /usr/bin/ffmpeg COPY --from=ffmpeg /usr/local/ffmpeg/bin/ffprobe /usr/bin/ffprobe COPY --from=ffmpeg /usr/local/ffmpeg/lib /usr/local/lib diff --git a/bootstrap/app.php b/bootstrap/app.php index 10e4c6f5c..551ead683 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -69,6 +69,7 @@ return Application::configure(basePath: dirname(__DIR__)) }, channels: __DIR__.'/../routes/channels.php', commands: __DIR__.'/../routes/console.php', + health: '/up', ) ->withMiddleware(function (Middleware $middleware) { $middleware->use([ diff --git a/docker-compose.yml b/docker-compose.yml index ac7e9b10f..a568a692d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -62,6 +62,8 @@ services: PHP_POST_MAX_SIZE: "500M" PHP_UPLOAD_MAX_FILE_SIZE: "500M" PHP_OPCACHE_ENABLE: "1" + PHP_OPCACHE_VALIDATE_TIMESTAMPS: "0" + HEALTHCHECK_PATH: "/up" # Laravel Auto-run Configuration AUTORUN_ENABLED: "true" @@ -72,12 +74,17 @@ services: AUTORUN_LARAVEL_ROUTE_CACHE: "true" AUTORUN_LARAVEL_VIEW_CACHE: "true" AUTORUN_LARAVEL_CONFIG_CACHE: "true" - volumes: - ./storage:/var/www/html/storage depends_on: - db - redis + healthcheck: + test: ["CMD", "healthcheck-frankenphp"] + interval: 10s + timeout: 5s + retries: 3 + start_period: 30s networks: - pixelfed-network @@ -91,6 +98,12 @@ services: env_file: - .env environment: + # PHP Configuration + PHP_POST_MAX_SIZE: "500M" + PHP_UPLOAD_MAX_FILE_SIZE: "500M" + PHP_OPCACHE_ENABLE: "1" + PHP_OPCACHE_VALIDATE_TIMESTAMPS: "0" + # Laravel Auto-run Configuration AUTORUN_ENABLED: "false" AUTORUN_LARAVEL_MIGRATION: "false" @@ -100,16 +113,13 @@ services: AUTORUN_LARAVEL_ROUTE_CACHE: "false" AUTORUN_LARAVEL_VIEW_CACHE: "false" AUTORUN_LARAVEL_CONFIG_CACHE: "true" - PHP_POST_MAX_SIZE: "500M" - PHP_UPLOAD_MAX_FILE_SIZE: "500M" - PHP_OPCACHE_ENABLE: "1" volumes: - ./storage:/var/www/html/storage depends_on: - db - redis healthcheck: - test: ["CMD", "php", "artisan", "horizon:status"] + test: ["CMD", "healthcheck-horizon"] interval: 10s timeout: 5s retries: 3 @@ -127,6 +137,12 @@ services: env_file: - .env environment: + # PHP Configuration + PHP_POST_MAX_SIZE: "500M" + PHP_UPLOAD_MAX_FILE_SIZE: "500M" + PHP_OPCACHE_ENABLE: "1" + PHP_OPCACHE_VALIDATE_TIMESTAMPS: "0" + # Laravel Auto-run Configuration AUTORUN_ENABLED: "false" AUTORUN_LARAVEL_MIGRATION: "false" @@ -136,9 +152,6 @@ services: AUTORUN_LARAVEL_ROUTE_CACHE: "false" AUTORUN_LARAVEL_VIEW_CACHE: "false" AUTORUN_LARAVEL_CONFIG_CACHE: "true" - PHP_POST_MAX_SIZE: "500M" - PHP_UPLOAD_MAX_FILE_SIZE: "500M" - PHP_OPCACHE_ENABLE: "1" volumes: - ./storage:/var/www/html/storage depends_on: @@ -146,6 +159,9 @@ services: - redis healthcheck: test: ["CMD", "healthcheck-schedule"] + interval: 10s + timeout: 5s + retries: 3 start_period: 10s networks: - pixelfed-network diff --git a/docker/frankenphp/caddyfile-global.d/max-header-size.caddyfile b/docker/frankenphp/caddyfile-global.d/max-header-size.caddyfile new file mode 100644 index 000000000..85352bb4d --- /dev/null +++ b/docker/frankenphp/caddyfile-global.d/max-header-size.caddyfile @@ -0,0 +1,3 @@ +servers { + max_header_size 128KiB +}