smacks/flixcooks-website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Dockerfile to disable AllowOverride for production, enhance admin.php to handle missing FLIXCOOKS_ADMIN_KEY with a user-friendly error page, and remove .htaccess file. Adjust documentation to reflect these changes and clarify admin key configuration.

Browse Source
This commit is contained in:
smacks
2026-05-23 13:29:35 +02:00
parent 830950ad66
commit d8bb062c63
5 changed files with 32 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.htaccess
-4
View File
@@ -1,4 +0,0 @@
#KONSOLEH AREA START - PLEASE DO NOT EDIT MANUALLY BETWEEN THESE LINES
DirectoryIndex index.php
#KONSOLEH AREA END - PLEASE ADD MANUAL CHANGES BELOW
SetEnv FLIXCOOKS_ADMIN_KEY "vFDH.N_tVLEKNdR3fhLs"
Dockerfile
+2 -2
View File
@@ -7,13 +7,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& a2enmod rewrite headers \ && a2enmod rewrite headers \
&& rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/apt/lists/*
# Apache: document root + AllowOverride for .htaccess # Apache: document root, no per-directory overrides in production
ENV APACHE_DOCUMENT_ROOT=/var/www/html ENV APACHE_DOCUMENT_ROOT=/var/www/html
RUN sed -ri 's!/var/www/html!${APACHE_DOCUMENT_ROOT}!g' /etc/apache2/sites-available/*.conf \ RUN sed -ri 's!/var/www/html!${APACHE_DOCUMENT_ROOT}!g' /etc/apache2/sites-available/*.conf \
&& sed -ri 's!/var/www/!${APACHE_DOCUMENT_ROOT}!g' /etc/apache2/apache2.conf /etc/apache2/conf-available/*.conf \ && sed -ri 's!/var/www/!${APACHE_DOCUMENT_ROOT}!g' /etc/apache2/apache2.conf /etc/apache2/conf-available/*.conf \
&& printf '%s\n' \ && printf '%s\n' \
'<Directory /var/www/html>' \ '<Directory /var/www/html>' \
' AllowOverride All' \ ' AllowOverride None' \
' Require all granted' \ ' Require all granted' \
'</Directory>' \ '</Directory>' \
> /etc/apache2/conf-available/flixcooks.conf \ > /etc/apache2/conf-available/flixcooks.conf \
README.md
+1 -1
View File
@@ -128,7 +128,7 @@ http://localhost:8000
#### Option B: Local Apache (XAMPP / MAMP / WAMP) #### Option B: Local Apache (XAMPP / MAMP / WAMP)
If you prefer running a full local stack: If you prefer running a full local stack:
1. Move or link the project directory inside your local server's document root (e.g., `htdocs` or `www`). 1. Move or link the project directory inside your local server's document root (e.g., `htdocs` or `www`).
2. Ensure URL rewriting is enabled (the included `.htaccess` file handles caching and custom redirections). 2. Configure the virtual host to serve `index.php` as the directory index.
3. Access the site via your custom local virtual host (e.g., `http://localhost/flixcooks-website`). 3. Access the site via your custom local virtual host (e.g., `http://localhost/flixcooks-website`).
--- ---
admin.php
+28 -1
View File
@@ -2,9 +2,36 @@
session_start(); session_start();
require __DIR__ . '/helpers.php'; require __DIR__ . '/helpers.php';
$ADMIN_KEY = getenv('FLIXCOOKS_ADMIN_KEY') ?: 'vFDH.N_tVLEKNdR3fhLs'; $ADMIN_KEY = getenv('FLIXCOOKS_ADMIN_KEY') ?: '';
$authed = isset($_SESSION['fc_admin']) && $_SESSION['fc_admin'] === true; $authed = isset($_SESSION['fc_admin']) && $_SESSION['fc_admin'] === true;
if ($ADMIN_KEY === '') {
http_response_code(503);
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>FlixCooks Admin Unavailable</title>
<link rel="stylesheet" href="/assets/style.css">
<style>
body { display: grid; place-items: center; min-height: 100vh; }
.login-card { background: #fff; padding: 24px; border-radius: 16px; box-shadow: var(--shadow); width: min(420px, 90vw); }
.error { color: #b00020; margin: 0; }
</style>
</head>
<body>
<div class="login-card">
<h1>Admin unavailable</h1>
<p class="error">FLIXCOOKS_ADMIN_KEY is not configured.</p>
</div>
</body>
</html>
<?php
exit;
}
if (!$authed && isset($_POST['password'])) { if (!$authed && isset($_POST['password'])) {
if (hash_equals($ADMIN_KEY, $_POST['password'])) { if (hash_equals($ADMIN_KEY, $_POST['password'])) {
$_SESSION['fc_admin'] = true; $_SESSION['fc_admin'] = true;
docs/COOLIFY.md
+1 -1
View File
@@ -130,7 +130,7 @@ curl http://127.0.0.1:8080/health.php
## 6. Sicherheit ## 6. Sicherheit
- `.env` wird **nicht** ins Image kopiert (`.dockerignore`). - `.env` wird **nicht** ins Image kopiert (`.dockerignore`).
- Admin-Key **nur** über `FLIXCOOKS_ADMIN_KEY` in Coolify, nicht in `.htaccess` für Production verlassen. - Admin-Key **nur** über `FLIXCOOKS_ADMIN_KEY` in Coolify setzen. Ohne diese Variable ist `/admin.php` deaktiviert.
- Postgres nicht öffentlich exponieren, wenn nicht nötig (nur interne URL). - Postgres nicht öffentlich exponieren, wenn nicht nötig (nur interne URL).
--- ---