Future Website Concept

.docker/dev/Dockerfile

@@ -0,0 +1,46 @@
+# Development Docker
+#
+# Provides the main runtime engine as well as tooling for running
+# during development
+#
+# NOTES:
+# - Does not copy and files in as it is expected to be handled via a mount
+
+FROM php:8.4-cli
+
+# Codebase doesn't have production flag so we negate it instead with
+# the DEVELOPMENT flag
+ENV DEVELOPMENT=1
+
+#
+# install additional development tooling
+#
+RUN apt update  \
+    && apt-get install -y --no-install-recommends git unzip \
+    && rm -rf /var/lib/apt/lists/*
+
+#
+# Composer is required for dev dependencies
+#
+RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" \
+    && php -r "if (hash_file('sha384', 'composer-setup.php') === 'c8b085408188070d5f52bcfe4ecfbee5f727afa458b2573b8eaaf77b3419b0bf2768dc67c86944da1544f06fa544fd47') { echo 'Installer verified'.PHP_EOL; } else { echo 'Installer corrupt'.PHP_EOL; unlink('composer-setup.php'); exit(1); }" \
+    && php composer-setup.php \
+    && php -r "unlink('composer-setup.php');" \
+    && mv composer.phar /usr/local/bin/composer
+
+#
+#  node.js - used for socket.dev and other front-end tooling
+#
+RUN apt-get update && apt-get install -y curl gnupg ca-certificates \
+    && mkdir -p /etc/apt/keyrings \
+    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \
+    && apt-get update && apt-get install -y nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+#
+# Global dependencies and tools brought in via npm
+#
+RUN npm install -g socket
+
+WORKDIR /app

.docker/prod/Dockerfile

@@ -0,0 +1,13 @@
+# "Production" Docker
+#
+# Provides the main runtime for PHP when deploying to a "Production"
+# or "Testing" environment that needs a full container using
+# the inbuilt server (not recommended).
+
+FROM php:8.4-cli
+
+# All of the files from the source location are copied into
+# the /app folder
+RUN mkdir /app
+WORKDIR /app
+COPY . /app

.dockerignore

@@ -0,0 +1,7 @@
+# .dockerignore
+.git
+.gitmodules
+.gitattributes
+.idea
+build-deploy.sh
+/var/composer

.gitignore

@@ -10,3 +10,6 @@ node_modules/
 /playwright-report/
 /blob-report/
 /playwright/.cache/
+/releases/[0-9]*_[0-9]*_[0-9]*.php
+/releases/[0-9]*_[0-9]*_[0-9]*_fr.php
+/releases/[0-9]*_[0-9]*_[0-9]*_win32.php

.router.php

@@ -1,15 +1,38 @@
 <?php
 
+use phpweb\HTTP\Request;
+use phpweb\HTTP\RequestHandler;
+
+require_once __DIR__ . '/src/autoload.php';
+
 $_SERVER["SERVER_ADDR"] = $_SERVER["HTTP_HOST"];
 
 $filename = $_SERVER["PATH_INFO"] ?? $_SERVER["SCRIPT_NAME"];
 
-if (!file_exists($_SERVER["DOCUMENT_ROOT"] . $filename)) {
+///* path-based routing takes precedence, */
+$request = Request::fromGlobals();
+new RequestHandler()->handleErrorRouting();
+
+$wantedPath = realpath($_SERVER["DOCUMENT_ROOT"] . $filename);
+if ($wantedPath === false || is_dir($wantedPath) || !str_starts_with($wantedPath, __DIR__ . '/')) {
     require_once __DIR__ . '/error.php';
 
     return;
 }
 
+/**
+ * Unfortunately, we do not yet have a dedicated public folder, meaning the entire directory
+ * structure is exposed.
+ *
+ * These rules try and lock it down some.
+ */
+foreach (RequestHandler::DENYLIST as $testRule) {
+    if (fnmatch(__DIR__ . '/' . $testRule, $wantedPath, FNM_CASEFOLD)) {
+        header('HTTP/1.0 403 Access Denied');
+        die('Access Denied');
+    }
+}
+
 /* This could be an image or whatever, so don't try to compress it */
 ini_set("zlib.output_compression", 0);
 return false;