Commit 815d8bf1 authored by Laurent Lecluse's avatar Laurent Lecluse
Browse files

sécurisation & config prod

parent 38f6a920

.env.example

+2 −2
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ APP_HOST=ose.localhost.unicaen.fr 
# Nom visible de l'application, à l'affichage

#APP_LABEL=OSE



# Environnement, 3 valeurs possibles : dev, test, prod

# Environnement, x valeurs possibles : dev, toutes les autres = prod

APP_ENV=dev



# Fuseau horaire de l'application
@@ -38,7 +38,7 @@ DEV_HOST_USER_ID=1000 
#            Mail           #

#---------------------------#

# Si MAIL_ENABLED=true et les paramètres de mail sont vides, alors un conteneur local sera cré pour héberger un mail catcher

MAIL_ENABLED=true

#MAIL_ENABLED=true

#MAIL_MAILDEV_PORT=1080

#MAIL_SMTP_HOST=

#MAIL_SMTP_PORT=25

Makefile

+6 −0
Original line number Diff line number Diff line
@@ -81,6 +81,12 @@ clear-cache: ## Vide le cache de l'application 






restart: ## Redémarre l'application

	docker compose restart

.PHONY: restart







rebuild: ## Reconstruit tous les conteneurs

	docker compose down -v

	docker compose build --no-cache

docker/apache/Dockerfile

+2 −0
Original line number Diff line number Diff line
@@ -16,7 +16,9 @@ RUN apk add --no-cache supervisor 


# Ajout de notre propre config Apache

RUN echo "Include conf/extra/docker.conf" >> /usr/local/apache2/conf/httpd.conf

RUN echo "Include conf/extra/security.conf" >> /usr/local/apache2/conf/security.conf



# Configuration de l'application

COPY httpd.conf /usr/local/apache2/conf/extra/docker.conf

COPY security.conf /usr/local/apache2/conf/extra/security.conf

docker/apache/security.conf

0 → 100644
+65 −0
Original line number Diff line number Diff line 
# Changing the following options will not really affect the security of the

# server, but might make attacks slightly more difficult in some cases.



#

# ServerTokens

# This directive configures what you return as the Server HTTP response

# Header. The default is 'Full' which sends information about the OS-Type

# and compiled in modules.

# Set to one of:  Full | OS | Minimal | Minor | Major | Prod

# where Full conveys the most information, and Prod the least.

#ServerTokens Minimal

ServerTokens Prod

#ServerTokens Full



#

# Optionally add a line containing the server version and virtual host

# name to server-generated pages (internal error documents, FTP directory

# listings, mod_status and mod_info output etc., but not CGI generated

# documents or custom error documents).

# Set to "EMail" to also include a mailto: link to the ServerAdmin.

# Set to one of:  On | Off | EMail

#ServerSignature Off

ServerSignature Off



#

# Allow TRACE method

#

# Set to "extended" to also reflect the request body (only for testing and

# diagnostic purposes).

#

# Set to one of:  On | Off | extended

TraceEnable Off

#TraceEnable On



#

# Forbid access to version control directories & .env files

#

# If you use version control systems in your document root, you should

# probably deny access to their directories.

#

# Examples:

#

RedirectMatch 404 /\.git

RedirectMatch 404 /\.svn

RedirectMatch 404 /\.env



#

# Setting this header will prevent MSIE from interpreting files as something

# else than declared by the content type in the HTTP headers.

# Requires mod_headers to be enabled.

#

Header set X-Content-Type-Options: "nosniff"



#

# Setting this header will prevent other sites from embedding pages from this

# site as frames. This defends against clickjacking attacks.

# Requires mod_headers to be enabled.

#

Header always append X-Frame-Options deny



# Mesures de protection supplémentaires

Header set Content-Security-Policy "default-src 'self' 'unsafe-inline'; img-src 'self' *.unicaen.fr data:; script-src 'self' 'uns>

Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=strict

Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Header set X-XSS-Protection "1; mode=block"

docker/php/Dockerfile

+11 −5
Original line number Diff line number Diff line
@@ -49,15 +49,21 @@ RUN install-php-extensions \ 
        iconv \

	;



# Xdebug optionnel

# Copier configs PHP

COPY php.dev.ini /usr/local/etc/php/php.dev.ini

COPY php.prod.ini /usr/local/etc/php/php.prod.ini

COPY fpm.conf /usr/local/etc/php-fpm.d/www.conf



# Switch dev/prod

RUN if [ "$APP_ENV" = "dev" ]; then \

      install-php-extensions xdebug; \

      rm /usr/local/etc/php/php.prod.ini; \

      mv /usr/local/etc/php/php.dev.ini /usr/local/etc/php/php.ini; \

else \

      rm /usr/local/etc/php/php.dev.ini; \

      mv /usr/local/etc/php/php.prod.ini /usr/local/etc/php/php.ini; \

fi



# Copier configs PHP

COPY php.ini /usr/local/etc/php/php.ini

COPY fpm.conf /usr/local/etc/php-fpm.d/www.conf



# Fournit un script d'entrée pour lancer PHP-FPM

COPY --chmod=755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint