cyberia 3.0.3 → 3.2.5

package/src/runtime/express/Express.js

@@ -79,6 +79,7 @@ class ExpressService {
     peer,
     valkey,
     apiBaseHost,
+    grpc,
     redirectTarget,
     rootHostPath,
     confSSR,
@@ -135,7 +136,17 @@ class ExpressService {
     });
 
     // Static file serving
-    app.use('/', express.static(directory ? directory : `.${rootHostPath}`));
+    app.use(
+      '/',
+      express.static(directory ? directory : `.${rootHostPath}`, {
+        setHeaders: (res, filePath) => {
+          if (filePath.includes('/assets/')) {
+            res.set('Access-Control-Allow-Origin', '*');
+            res.set('Cross-Origin-Resource-Policy', 'cross-origin');
+          }
+        },
+      }),
+    );
 
     // Handle redirection-only instances
     if (redirect) {
@@ -165,14 +176,7 @@ class ExpressService {
         });
       }
 
-      // Swagger UI setup
-      if (fs.existsSync(swaggerJsonPath)) {
-        const swaggerDoc = JSON.parse(fs.readFileSync(swaggerJsonPath, 'utf8'));
-        const swaggerUiOptions = await buildSwaggerUiOptions();
-        app.use(swaggerPath, swaggerUi.serve, swaggerUi.setup(swaggerDoc, swaggerUiOptions));
-      }
-
-      // Security and CORS
+      // Security and CORS — must run before swagger-ui so CSP headers are included in swagger responses
       if (process.env.NODE_ENV === 'development' && useLocalSsl)
         origins = origins.map((origin) => origin.replace('http', 'https'));
 
@@ -180,6 +184,13 @@ class ExpressService {
         origin: origins,
       });
 
+      // Swagger UI setup (after security middleware so responses carry correct CSP headers)
+      if (fs.existsSync(swaggerJsonPath)) {
+        const swaggerDoc = JSON.parse(fs.readFileSync(swaggerJsonPath, 'utf8'));
+        const swaggerUiOptions = await buildSwaggerUiOptions();
+        app.use(swaggerPath, swaggerUi.serve, swaggerUi.setup(swaggerDoc, swaggerUiOptions));
+      }
+
       // Database and Valkey connections
       if (db && apis) await DataBaseProvider.load({ apis, host, path, db });
 
@@ -198,6 +209,12 @@ class ExpressService {
         });
       }
 
+      // gRPC server
+      if (path === '/' && grpc && grpc.module) {
+        const { GrpcServer } = await import(`../../grpc/${grpc.module}/grpc-server.js`);
+        await GrpcServer.start({ host, path, port: grpc.port || 50051 });
+      }
+
       // API router loading
       if (apis && apis.length > 0) {
         const authMiddleware = authMiddlewareFactory({ host, path });
@@ -249,7 +266,13 @@ class ExpressService {
     for (const [_, ssrMiddleware] of Object.entries(ssr)) app.use(ssrMiddleware);
 
     // Start listening on the main port
-    if (useLocalSsl && process.env.NODE_ENV === 'development') {
+    // When behind a dev proxy (isDevProxyContext), the proxy handles TLS termination,
+    // so backend servers should listen on plain HTTP to be reachable via http://localhost:PORT
+    if (
+      (useLocalSsl || process.argv.find((arg) => arg === 'tls')) &&
+      process.env.NODE_ENV === 'development' &&
+      !isDevProxyContext()
+    ) {
       if (!Underpost.tls.validateSecureContext()) shellExec(`node bin/deploy tls`);
       const { ServerSSL } = await Underpost.tls.createSslServer(app);
       await Underpost.start.listenPortController(ServerSSL, port, runningData);

package/src/runtime/lampp/Dockerfile

@@ -20,8 +20,8 @@ RUN dnf -y update && \
     perl && \
     dnf clean all
 
-# --- Download and install XAMPP
-RUN curl -L -o /tmp/xampp-linux-installer.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/7.4.33/xampp-linux-x64-7.4.33-0-installer.run" && \
+# --- Download and install XAMPP (PHP 8.2)
+RUN curl -L -o /tmp/xampp-linux-installer.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/8.2.12/xampp-linux-x64-8.2.12-0-installer.run" && \
     chmod +x /tmp/xampp-linux-installer.run && \
     bash -c "/tmp/xampp-linux-installer.run --mode unattended" && \
     ln -sf /opt/lampp/lampp /usr/bin/lampp
@@ -31,6 +31,13 @@ RUN mkdir -p /opt/lampp/htdocs && \
     chown -R root:root /opt/lampp/htdocs && \
     chmod -R a+rX /opt/lampp/htdocs
 
+# Add XAMPP binaries and /usr/local/bin to PATH for all shells
+ENV PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"
+RUN echo 'export PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"' > /etc/profile.d/lampp.sh
+
+# Provide a no-op sendmail so PHP plugins don't error on mail calls
+RUN printf '#!/bin/sh\ncat > /dev/null\n' > /usr/sbin/sendmail && chmod +x /usr/sbin/sendmail
+
 # Install Node.js
 RUN curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
 RUN dnf install nodejs -y
@@ -40,6 +47,10 @@ RUN dnf clean all
 RUN node --version
 RUN npm --version
 
+# Create non-root user for secure container execution (cron jobs, init containers)
+# Deployment containers override to root via securityContext when npm install -g is needed
+RUN useradd -m -u 1000 -s /bin/bash dd
+
 # Set working directory
 WORKDIR /home/dd
 

package/src/runtime/lampp/Lampp.js

@@ -21,11 +21,11 @@ const logger = loggerFactory(import.meta);
 class LamppService {
   /**
    * @method
-   * @type {string | undefined}
+   * @type {string}
    * @description Stores the accumulated Apache virtual host configuration (router definition).
    * @memberof LamppService
    */
-  router;
+  router = '';
 
   /**
    * @public
@@ -42,7 +42,7 @@ class LamppService {
    * @memberof LamppService
    */
   constructor() {
-    this.router = undefined;
+    this.router = '';
     this.ports = [];
   }
 
@@ -125,7 +125,6 @@ class LamppService {
 
     // 6. Start the service
     cmd = `sudo /opt/lampp/lampp start`;
-    if (this.router) fs.writeFileSync(`./tmp/lampp-router.conf`, this.router, 'utf-8');
     shellExec(cmd);
   }
 
@@ -139,13 +138,7 @@ class LamppService {
    * @memberof LamppService
    */
   appendRouter(render) {
-    if (!this.router) {
-      if (fs.existsSync(`./tmp/lampp-router.conf`)) {
-        this.router = fs.readFileSync(`./tmp/lampp-router.conf`, 'utf-8');
-        return this.router + render;
-      }
-      return (this.router = render);
-    }
+    if (!this.router) return (this.router = render);
     return (this.router += render);
   }
 
@@ -154,10 +147,10 @@ class LamppService {
    *
    * @memberof LamppService
    * @returns {void}
+   * @method removeRouter
    */
   removeRouter() {
-    this.router = undefined;
-    if (fs.existsSync(`./tmp/lampp-router.conf`)) fs.rmSync(`./tmp/lampp-router.conf`);
+    this.router = '';
   }
 
   /**
@@ -176,9 +169,9 @@ class LamppService {
       shellCd(`./engine-private/setup`);
 
       if (!process.argv.includes(`server`)) {
-        // Download and run the XAMPP installer
+        // Download and run the XAMPP installer (PHP 8.2)
         shellExec(
-          `curl -Lo xampp-linux-installer.run https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/7.4.30/xampp-linux-x64-7.4.30-1-installer.run?from_af=true`,
+          `curl -Lo xampp-linux-installer.run https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/8.2.12/xampp-linux-x64-8.2.12-0-installer.run`,
         );
         shellExec(`sudo chmod +x xampp-linux-installer.run`);
         shellExec(
@@ -244,14 +237,37 @@ Listen ${port}
 
 <VirtualHost *:${port}>
   DocumentRoot "${documentRoot}"
-  ServerName ${host}:${port}
+  ServerName ${host}
+  UseCanonicalName Off
+  ServerSignature Off
 
   <Directory "${documentRoot}">
-    Options Indexes FollowSymLinks MultiViews
+    Options FollowSymLinks MultiViews
     AllowOverride All
     Require all granted
   </Directory>
 
+  # Block access to .git directories and files
+  RedirectMatch 404 /\\.git
+
+  # Block access to hidden dotfiles (.env, .htpasswd, etc.)
+  <FilesMatch "^\\.(env|htpasswd|htaccess\\.bak|DS_Store)">
+    Require all denied
+  </FilesMatch>
+
+  # Block access to sensitive engine files
+  <FilesMatch "(wp-config\\.php\\.bak|wp-config-sample\\.php|\\.sql|\\.sql\\.gz)$">
+    Require all denied
+  </FilesMatch>
+
+  # Security headers
+  <IfModule mod_headers.c>
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always unset X-Powered-By
+  </IfModule>
+
   ${
     redirect
       ? `

package/src/runtime/wp/Dockerfile

@@ -0,0 +1,68 @@
+FROM rockylinux:9
+
+# Update and install required packages
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing \
+    bzip2 \
+    sudo \
+    curl \
+    unzip \
+    net-tools \
+    openssh-server \
+    nano \
+    vim-enhanced \
+    less \
+    openssl-devel \
+    wget \
+    git \
+    gnupg2 \
+    libnsl \
+    perl && \
+    dnf clean all
+
+# --- Download and install XAMPP (PHP 8.2)
+RUN curl -L -o /tmp/xampp-linux-installer.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/8.2.12/xampp-linux-x64-8.2.12-0-installer.run" && \
+    chmod +x /tmp/xampp-linux-installer.run && \
+    bash -c "/tmp/xampp-linux-installer.run --mode unattended" && \
+    ln -sf /opt/lampp/lampp /usr/bin/lampp
+
+# --- Create /xampp/htdocs (static root) and set permissions
+RUN mkdir -p /opt/lampp/htdocs && \
+    chown -R root:root /opt/lampp/htdocs && \
+    chmod -R a+rX /opt/lampp/htdocs
+
+# Add XAMPP binaries and /usr/local/bin to PATH for all shells
+ENV PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"
+RUN echo 'export PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"' > /etc/profile.d/lampp.sh
+
+# Provide a no-op sendmail so WP plugins don't error on mail calls
+RUN printf '#!/bin/sh\ncat > /dev/null\n' > /usr/sbin/sendmail && chmod +x /usr/sbin/sendmail
+
+# Install WP-CLI
+RUN curl -sL https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar -o /usr/local/bin/wp && \
+    chmod +x /usr/local/bin/wp && \
+    wp --info --allow-root
+
+# Install Node.js
+RUN curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
+RUN dnf install nodejs -y
+RUN dnf clean all
+
+# Verify Node.js and npm versions
+RUN node --version
+RUN npm --version
+
+# Create non-root user for secure container execution (cron jobs, init containers)
+# Deployment containers override to root via securityContext when npm install -g is needed
+RUN useradd -m -u 1000 -s /bin/bash dd
+
+# Set working directory
+WORKDIR /home/dd
+
+EXPOSE 22
+EXPOSE 80
+EXPOSE 443
+EXPOSE 3000-3100
+EXPOSE 4000-4100
+