Pontoporeia
554fc57455
The passive scan flagged 3x MEDIUM 'PHPSESSID missing Secure' and an
admin-login cookie missing HttpOnly. Root cause was not the cookie code
but scheme detection: every call site read $_SERVER['HTTPS'] directly,
which is unset when TLS is terminated in front of PHP-FPM, so the Secure
flag was silently dropped.
Add RequestUtil::isSecure()/baseUrl() as the single scheme detector:
1. $_SERVER['HTTPS'] (direct TLS)
2. X-Forwarded-Proto — only from a loopback/private peer, so a remote
client cannot spoof it
3. SERVER_PORT == 443
Replace all 8 inline $_SERVER['HTTPS'] idioms (App, AdminAuth, 4x filepond
endpoints, validate-access, admin/acces, SystemController self-ping).
nginx: forward the scheme to php-fpm in all 4 fastcgi blocks
(fastcgi_param HTTPS $https + X-Forwarded-Proto $scheme) and uncomment
server_tokens off. Config validated with nginx -t (real config, alpine
container).
AdminAuth: logout() now clears the session cookie with the same
path/domain/secure/httponly/samesite it was set with, instead of the
legacy positional setcookie() that dropped SameSite.
Tests (+24, 340 total):
- RequestUtilTest: scheme detection incl. proxy trust boundaries
- SessionCookieTest: logout emits a hardened deletion cookie
- PeerTubeIntegrationTest: PeerTube keeps using its absolute instance_url
and is unaffected by scheme changes (Guzzle MockHandler)
- NginxConfigTest: pins HTTPS forwarding, HSTS includeSubDomains,
server_tokens off
PeerTube uses an absolute instance_url from the DB and never derives URLs
from the request, so the integration is unchanged — the regression tests
lock that invariant in.
XAMXAM
(Anciennement Posterg)
Répertoire des travaux de fin d'études de l'ERG (École de Recherche Graphique).
Requirements
- PHP ≥ 8.4 (with
ext-json,ext-openssl,ext-pdo,ext-sqlite3) - Composer
- Node.js / npm
- nginx (production)
Development
# one-time
composer install
npm ci
# run the dev server (builds assets, applies migrations, opens a browser)
just dev # http://127.0.0.1:8000 (public) and /admin/
just stop # stop it
Live CSS/JS rebuilds happen automatically via a chokidar watcher while just dev runs.
See docs/development.md for the full workflow.
Deployment
Files are pushed to the server with rsync — there is no repo on the remote.
just deploy # rsync app files → xamxam:/var/www/xamxam/
just deploy-db # push local xamxam.db → remote (only if remote DB is absent)
deploy-db refuses to run if a database already exists on the server, to avoid
accidental overwrites of production data.
First-time server setup
First bootstrap the role/user/dirs with scripts/setup-server.sh, then the one-shot
remote provisioning recipe, which deploys code, nginx, and cron jobs:
# 1. role/user/dir bootstrap (creates xamxam group, /var/www/xamxam, perms):
# equivalent to: ssh -t xamxam "sudo DEPLOY_USER=\$USER bash /tmp/setup-server.sh"
rsync scripts/setup-server.sh xamxam:/tmp/setup-server.sh
ssh -t xamxam "sudo DEPLOY_USER=\$USER bash /tmp/setup-server.sh"
# 2. full provisioning (env/APP_KEY + deploy + nginx + backup + cleanup cron + logrotate):
just provision-server
Fresh box caveat:
provision-serverassumessetup-server.shalready ran. On a truly empty/var/www/xamxam, runsetup-server.sh(or re-applydeploy-server.shviajust deploy-nginx) first, otherwise the deploy's rsync hitsPermission deniedonstorage/.
just deploy / just deploy-nginx apply code + nginx config:
just deploy
just deploy-nginx # included in `just deploy` and `just provision-server`
See docs/deployment.md for the full workflow and the podman test environment in test-env/README.md to validate any of this against a fresh throwaway box.
Security notes
- Admin panel protected by PHP session (
AdminAuth) — password-only, no username - Uploads stored outside webroot, served via controlled
/media(MediaController) - Rate limiting on public search (
app/src/RateLimit.php) - See
nginx/docs/SECURITY_HEADERS.mdfor security headers reference
More docs
See docs/README.md for the full documentation index.