From cd3f93bcc2d8e4a5934a19b13f7fdf30ee4e130c Mon Sep 17 00:00:00 2001 From: salmonik Date: Sun, 1 Nov 2026 22:34:19 +0100 Subject: web: serve latest.php through PHP and refuse stray PHP files nginx example now routes index.php and latest.php to php-fpm, sends the newest-version feed with no-store, keeps the stable installers revalidated, and returns 404 for every other .php request so releases.php cannot be downloaded as source. Documents Debian and Arch pool sockets. --- web/README.md | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) (limited to 'web/README.md') diff --git a/web/README.md b/web/README.md index 13f5f85..81346fd 100644 --- a/web/README.md +++ b/web/README.md @@ -71,34 +71,46 @@ Cargo itself cannot produce these names: it always writes ## nginx `web/nginx.conf.example` is a working server block for a subdomain with an -existing certificate. On Arch-based systems: +existing certificate. Debian/Ubuntu and Arch install it the same way: ```sh +# Debian / Ubuntu +sudo apt install nginx php-fpm +sudo install -d -o "$USER" -g www-data -m 0755 /srv/zagan.bet + +# Arch sudo pacman -S nginx php-fpm sudo install -d -o "$USER" -g http -m 0755 /srv/zagan.bet + sudo cp web/nginx.conf.example /etc/nginx/conf.d/zagan.bet.conf -# edit server_name, root and the certificate paths, then: +# edit server_name, root, socket and certificate paths, then: sudo nginx -t && sudo systemctl enable --now nginx php-fpm ``` -The pool socket and user are Arch defaults (`http`, -`/run/php-fpm/php-fpm.sock`). Check them and adjust `fastcgi_pass` if your -distribution differs: +The example uses Debian/Ubuntu's pool socket (`/run/php/php-fpm.sock`); Arch +uses `/run/php-fpm/php-fpm.sock`. Check the pool's user and socket and adjust +`fastcgi_pass` if your distribution differs: ```sh -grep -E '^(user|group|listen)' /etc/php/php-fpm.d/www.conf +grep -E '^(user|group|listen)' /etc/php/*/fpm/pool.d/www.conf /etc/php-fpm.d/www.conf 2>/dev/null ``` -`rsync` publishes files as `0755`/`0644`, so the `http` worker and the php-fpm -pool can read them without extra group juggling. `index.php` is the only -script; any other `.php` request 404s instead of executing. +`rsync` publishes files as `0755`/`0644`, so the PHP worker can read them +without extra group juggling. `index.php` and `latest.php` are the only +scripts; `releases.php` is an include, and the example returns 404 for every +other `.php` request instead of serving it as source. + +The example sends `/latest.php` with `no-store` and the two installers with +`no-cache`, so a new release is picked up immediately without giving up the +immutable caching on `/bin/`. PHP's opcache is enabled by default and revalidates timestamps every two -seconds, so a deployed `index.php` takes effect without reloading php-fpm. If -you ever set `opcache.validate_timestamps=0`, reload php-fpm after a deploy. +seconds, so a deployed `index.php` or `latest.php` takes effect without +reloading php-fpm. If you ever set `opcache.validate_timestamps=0`, reload +php-fpm after a deploy. -The php-fpm unit on Arch uses `PrivateTmp=`, so the hash cache in `/tmp` lives -in the service's private tmp. It still works; point `ZAGAN_HASH_CACHE` at a +The php-fpm unit often uses `PrivateTmp=`, so the hash cache in `/tmp` lives in +the service's private tmp. It still works; point `ZAGAN_HASH_CACHE` at a writable path such as `/var/cache/zagan-bet-hashes.json` if you want it to survive a service restart. -- cgit v1.2.3