generated from bisco/codex-bootstrap
bisco
29 lines
785 B
Bash
Executable File
29 lines
785 B
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
compose_file="${1:-/workspace/docker-compose.yml}"
|
|
|
|
awk '
|
|
/^[[:space:]]{2}wordpress:/ {
|
|
in_wordpress = 1
|
|
next
|
|
}
|
|
in_wordpress && /^[[:space:]]{2}[A-Za-z0-9_-]+:/ {
|
|
in_wordpress = 0
|
|
}
|
|
in_wordpress && /^[[:space:]]{4}ports:/ {
|
|
print "The wordpress service must not publish host ports; route traffic through proxy only." > "/dev/stderr"
|
|
exit 1
|
|
}
|
|
' "$compose_file"
|
|
|
|
grep -q 'azionelab-apache-hardening.conf' /workspace/wordpress/Dockerfile || {
|
|
echo "The WordPress image must install Apache hardening rules." >&2
|
|
exit 1
|
|
}
|
|
|
|
grep -q 'wp-content/(uploads|files)' /workspace/wordpress/apache-hardening.conf || {
|
|
echo "Apache hardening must block PHP execution below uploads/files." >&2
|
|
exit 1
|
|
}
|