Strenghten prod build on Docker (#284)

Co-authored-by: tchapi <regbasket@gmail.com>

Author: tchapi

.dockerignore

@@ -13,3 +13,6 @@ phpunit.xml.dist
 .dockerignore
 var/cache/*
 var/log/*
+var/*.db
+var/webdav
+var/tmp

.github/workflows/ci.yml

@@ -289,6 +289,28 @@ jobs:
       - name: Install dependencies with Composer
         run: composer install --no-progress --no-interaction --ansi --optimize-autoloader
 
+      # Regression check for #282: a `framework.profiler` block placed outside `when@dev` / `when@test`
+      # silently enables the Symfony profiler in *every* environment (any child key flips `enabled` to true).
+      # In production that writes a profile to var/cache/prod on every request and, when that directory
+      # is not writable (root-owned var/ in a Docker image), turns every request into a 500 with no log.
+      # We boot the real prod configuration and assert that neither the config nor the compiled container
+      # carries the profiler. The profiler must only ever be configured in config/packages/{dev,test}/.
+      - name: Check that the profiler is disabled in production
+        env:
+          APP_ENV: prod
+          APP_DEBUG: "0"
+        run: |
+          php bin/console debug:config framework profiler | tee /tmp/profiler-config.txt
+          if ! grep -q '^enabled: false' /tmp/profiler-config.txt; then
+            echo "❌ framework.profiler is enabled in the prod environment (see config/packages/framework.yaml)"
+            exit 1
+          fi
+          if php bin/console debug:container --tag=kernel.event_subscriber | grep -qi 'ProfilerListener'; then
+            echo "❌ The ProfilerListener is registered in the prod container"
+            exit 1
+          fi
+          echo "✅ Profiler disabled in production"
+
       - name: Prepare application
         env:
           DATABASE_URL: mysql://davis:davis@mysql:3306/davis_test

README.md

@@ -635,7 +635,7 @@ In a shell, if you run Davis locally:
 
 ### I have a 500 and a log about `Uncaught Error: Class "Symfony\Bundle\WebProfilerBundle\WebProfilerBundle" not found`
 
-You are running the app in dev mode, but you haven't installed the dev dependencies. Either:
+You are running the app in dev mode, but you haven't installed the dev dependencies (the Docker images default to `APP_ENV=prod`, so this only happens if you override it). Either:
 
 a. Set `APP_ENV=prod` in your local env file (See configuration above)
 

config/packages/dev/web_profiler.yaml

@@ -3,4 +3,6 @@ web_profiler:
     intercept_redirects: false
 
 framework:
-    profiler: { only_exceptions: false }
+    profiler:
+        only_exceptions: false
+        collect_serializer_data: true

config/packages/framework.yaml

@@ -14,9 +14,6 @@ framework:
         name: 'DAVIS_SESSION'
         storage_factory_id: session.storage.factory.native
 
-    profiler:
-        collect_serializer_data: true
-
     property_info:
         with_constructor_extractor: false
 

config/packages/test/web_profiler.yaml

@@ -3,4 +3,6 @@ web_profiler:
     intercept_redirects: false
 
 framework:
-    profiler: { collect: false }
+    profiler:
+        collect: false
+        collect_serializer_data: true

docker/Dockerfile

@@ -70,6 +70,9 @@ FROM base-image
 ARG fpm_user=82:82
 ENV FPM_USER=${fpm_user}
 
+# Production by default: the dev bundles are not installed in the image (composer --no-dev)
+ENV APP_ENV=prod
+
 ENV PHP_OPCACHE_MEMORY_CONSUMPTION="256" \
     PHP_OPCACHE_MAX_WASTED_PERCENTAGE="10"
 
@@ -100,6 +103,10 @@ RUN APP_ENV=prod COMPOSER_ALLOW_SUPERUSER=1 composer install --no-ansi --no-dev
     && php ./vendor/symfony/intl/Resources/bin/compress \
     && rm -rf /var/www/davis/docker
 
+# composer install (and its cache warmup) ran as root: give the runtime directories back to the FPM user,
+# otherwise PHP-FPM can neither write its cache nor its logs (500 on every request, and no log to tell)
+RUN mkdir -p var/log var/cache && chown -R ${FPM_USER} var
+
 USER $FPM_USER
 
 HEALTHCHECK --interval=30s --timeout=1s CMD php-fpm-healthcheck || exit 1

docker/Dockerfile-standalone

@@ -66,6 +66,9 @@ COPY ./docker/configurations/opcache.ini /usr/local/etc/php/conf.d/opcache.ini
 # Final image ————————————————————————————————————————————————————————————————————
 FROM base-image
 
+# Production by default: the dev bundles are not installed in the image (composer --no-dev)
+ENV APP_ENV=prod
+
 ENV PHP_OPCACHE_MEMORY_CONSUMPTION="256" \
     PHP_OPCACHE_MAX_WASTED_PERCENTAGE="10"
 

docker/configurations/Caddyfile

@@ -29,10 +29,16 @@
                 -X-Powered-By
 
                 # keep referrer data off of HTTP connections
-                Referrer-Policy no-referrer-when-downgrade
+                Referrer-Policy strict-origin-when-cross-origin
 
                 # disable clients from sniffing the media type
                 X-Content-Type-Options nosniff
+
+                # the admin UI is never meant to be framed
+                X-Frame-Options DENY
+
+                # no browser feature is needed
+                Permissions-Policy "camera=(), microphone=(), geolocation=()"
         }
 
 }

docker/configurations/nginx.conf

@@ -19,6 +19,13 @@ server {
 
     charset utf-8;
 
+    # Security headers (add `Strict-Transport-Security` once TLS is terminated in front of nginx)
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    server_tokens off;
+
     location ~ /(\.ht) {
         deny all;
         return 404;