Add 8.2 PROD

PHP8.2/PROD/Dockerfile

@@ -0,0 +1,72 @@
+FROM php:8.2-apache
+
+RUN apt-get update -qq && \
+    apt-get install -qy \
+    # Common
+    nano \
+    vim \
+    # GD
+    libfreetype6-dev \
+    libjpeg62-turbo-dev \
+    libpng-dev \
+    libwebp-dev \ 
+    libxpm-dev  \
+    # INTL 
+    zlib1g-dev libicu-dev g++ \
+    # XSL 
+    libxslt-dev \
+    # ZIP 
+    libzip-dev \
+    unzip \
+    zip \
+    # Imagick
+    libmagick++-dev \
+    libmagickwand-dev \
+    # Memcached
+    libmemcached-dev \
+    # ldap
+    ldap-utils libldap2-dev \
+    # locales
+    locales
+
+# LOCALES
+ENV DEBIAN_FRONTEND noninteractive
+RUN echo "fr_FR.UTF-8 UTF-8" > /etc/locale.gen && \
+    locale-gen fr_FR.UTF-8 && \
+    dpkg-reconfigure locales && \
+    /usr/sbin/update-locale LANG=fr_FR.UTF-8
+ENV LC_ALL fr_FR.UTF-8
+ENV LANG fr_FR.UTF-8  
+ENV LANGUAGE fr_FR.UTF-8:fr  
+# END LOCALES
+
+RUN docker-php-ext-configure gd \
+    --enable-gd \
+    --with-webp \
+    --with-jpeg \
+    --with-xpm \
+    --with-freetype
+
+RUN docker-php-ext-configure intl
+RUN docker-php-ext-configure zip --with-zip
+RUN docker-php-ext-configure ldap
+RUN docker-php-ext-install exif gd gettext intl mysqli pdo_mysql xsl opcache zip bcmath ldap
+
+RUN pecl install imagick-3.6.0 && docker-php-ext-enable imagick
+RUN pecl install memcached-3.1.5 && docker-php-ext-enable memcached
+
+#RUN useradd -ms /bin/bash noroot
+
+RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+COPY conf/common-apache.conf /etc/apache2/conf-available/z-app.conf
+COPY conf/common-ports.conf /etc/apache2/ports.conf
+COPY conf/common-security.conf /etc/apache2/conf-enabled/security.conf
+COPY conf/php.ini /usr/local/etc/php/conf.d/app.ini
+COPY conf/vhost.conf /etc/apache2/sites-available/000-default.conf
+
+RUN a2enmod rewrite remoteip headers && \
+    a2enconf z-app
+
+#USER noroot
+WORKDIR /app/srcs

PHP8.2/PROD/conf/common-apache.conf

@@ -0,0 +1,114 @@
+#User noroot
+#Group noroot
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 5
+
+#
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives.  See also the AllowOverride
+# directive.
+#
+
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being
+# viewed by Web clients.
+#
+<FilesMatch "^\.ht">
+        Require all denied
+</FilesMatch>
+
+# Block .git composer and npm files
+
+<FilesMatch "^composer\.(json|lock)">
+        Require all denied
+</FilesMatch>
+<FilesMatch "^package(-lock)?\.json">
+        Require all denied
+</FilesMatch>
+<FilesMatch "^\.">
+        Require all denied
+</FilesMatch>
+<DirectoryMatch "^\.|\/\.">
+        Require all denied
+</Directorymatch>
+
+#
+# DefaultType is the default MIME type the server will use for a document
+# if it cannot otherwise determine one, such as from filename extensions.
+# If your server contains mostly text or HTML documents, "text/plain" is
+# a good value.  If most of your content is binary, such as applications
+# or images, you may want to use "application/octet-stream" instead to
+# keep browsers from trying to display binary files as though they are
+# text.
+#
+# It is also possible to omit any default MIME type and let the
+# client's browser guess an appropriate action instead. Typically the
+# browser will decide based on the file's extension then. In cases
+# where no good assumption can be made, letting the default MIME type
+# unset is suggested  instead of forcing the browser to accept
+# incorrect  metadata.
+#
+DefaultType None
+
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog ${APACHE_LOG_DIR}/error.log
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+SetEnvIf Remote_Addr "127\.0\.0\.1" loopback
+SetEnvIf Request_URI "^/haproxytest\.txt$" dontlog
+SetEnvIf Request_URI  "^check_http" dontlog
+SetEnvIf Remote_Addr "127.0.0.1" dontlog
+SetEnvIf Remote_Addr "::1" dontlog
+
+# Include generic snippets of statements
+SetEnvIf Remote_Addr "127\.0\.0\.1" loopback
+SetEnvIf Request_URI "^/haproxytest\.txt$" dontlog

PHP8.2/PROD/conf/common-ports.conf

@@ -0,0 +1,7 @@
+# If you just change the port or add more ports here, you will likely also
+# have to change the VirtualHost statement in
+# /etc/apache2/sites-enabled/000-default.conf
+
+Listen 8080
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

PHP8.2/PROD/conf/common-security.conf

@@ -0,0 +1,74 @@
+#
+# Disable access to the entire file system except for the directories that
+# are explicitly allowed later.
+#
+# This currently breaks the configurations that come with some web application
+# Debian packages.
+#
+#<Directory />
+#   AllowOverride None
+#   Order Deny,Allow
+#   Deny from all
+#</Directory>
+
+
+# Changing the following options will not really affect the security of the
+# server, but might make attacks slightly more difficult in some cases.
+
+#
+# ServerTokens
+# This directive configures what you return as the Server HTTP response
+# Header. The default is 'Full' which sends information about the OS-Type
+# and compiled in modules.
+# Set to one of:  Full | OS | Minimal | Minor | Major | Prod
+# where Full conveys the most information, and Prod the least.
+#ServerTokens Minimal
+ServerTokens Prod
+#ServerTokens Full
+
+#
+# Optionally add a line containing the server version and virtual host
+# name to server-generated pages (internal error documents, FTP directory
+# listings, mod_status and mod_info output etc., but not CGI generated
+# documents or custom error documents).
+# Set to "EMail" to also include a mailto: link to the ServerAdmin.
+# Set to one of:  On | Off | EMail
+#ServerSignature Off
+ServerSignature Off
+
+#
+# Allow TRACE method
+#
+# Set to "extended" to also reflect the request body (only for testing and
+# diagnostic purposes).
+#
+# Set to one of:  On | Off | extended
+TraceEnable Off
+#TraceEnable On
+
+#
+# Forbid access to version control directories
+#
+# If you use version control systems in your document root, you should
+# probably deny access to their directories. For example, for subversion:
+#
+#<DirectoryMatch "/\.svn">
+#   Require all denied
+#</DirectoryMatch>
+
+#
+# Setting this header will prevent MSIE from interpreting files as something
+# else than declared by the content type in the HTTP headers.
+# Requires mod_headers to be enabled.
+#
+#Header set X-Content-Type-Options: "nosniff"
+
+#
+# Setting this header will prevent other sites from embedding pages from this
+# site as frames. This defends against clickjacking attacks.
+# Requires mod_headers to be enabled.
+#
+#Header set X-Frame-Options: "sameorigin"
+
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

PHP8.2/PROD/conf/vhost.conf

@@ -0,0 +1,15 @@
+<VirtualHost *:8080>
+	ServerAdmin contact@ldc.fr
+	DocumentRoot /app/srcs/public
+
+    <Directory /app/srcs/public>
+        Options +MultiViews -Indexes +FollowSymLinks
+        AllowOverride All
+        Require all granted
+
+        php_admin_value open_basedir /app/srcs/
+
+        SetEnvIf X_FORWARDED_PROTO https HTTPS=on
+    </Directory>
+
+</VirtualHost>