first sync

misp/core/files/etc/nginx/sites-available/misp

@@ -0,0 +1,53 @@
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    # define the root dir
+    root /var/www/MISP/app/webroot;
+    index index.php;
+
+    client_max_body_size 50M;
+
+    # disable access logs
+    access_log off;
+    log_not_found off;
+    error_log  /dev/stderr error;
+
+    ssl_certificate /etc/nginx/certs/cert.pem;
+    ssl_certificate_key /etc/nginx/certs/key.pem;
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+    ssl_session_tickets off;
+
+    # intermediate configuration
+    ssl_dhparam /etc/nginx/certs/dhparams.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    # enable HSTS
+    add_header Strict-Transport-Security "max-age=15768000; includeSubdomains";
+    add_header X-Frame-Options SAMEORIGIN;
+
+    # added headers for hardening browser security
+    add_header Referrer-Policy "no-referrer" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Download-Options "noopen" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Permitted-Cross-Domain-Policies "none" always;
+    add_header X-Robots-Tag "none" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # remove X-Powered-By, which is an information leak
+    fastcgi_hide_header X-Powered-By;
+
+    location / {
+        try_files $uri $uri/ /index.php$is_args$query_string;
+    }
+
+    location ~ \.php$ {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+        fastcgi_read_timeout 300;
+    }
+}

misp/core/files/etc/nginx/sites-available/misp80

@@ -0,0 +1,11 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    # Disable access logs
+    access_log off;
+    log_not_found off;
+    error_log  /dev/stderr error;
+
+    return 301 https://$host$request_uri;
+}

misp/core/files/etc/supervisor/conf.d/10-supervisor.conf

@@ -0,0 +1,39 @@
+[supervisord]
+nodaemon=true
+user=root
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[inet_http_server]
+port=127.0.0.1:9001
+username=supervisor
+password=supervisor
+
+[program:nginx]
+command=/entrypoint_nginx.sh
+autorestart=true
+redirect_stderr=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:php-fpm]
+command=/entrypoint_fpm.sh
+autorestart=true
+redirect_stderr=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:cron]
+command=/entrypoint_cron.sh
+autorestart=true
+redirect_stderr=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0

misp/core/files/etc/supervisor/conf.d/50-workers.conf

@@ -0,0 +1,68 @@
+# Workers are set to NOT auto start so we have time to enforce permissions on the cache first
+
+[group:misp-workers]
+programs=default,email,cache,prio,update
+
+[program:default]
+directory=/var/www/MISP
+command=/var/www/MISP/app/Console/cake start_worker default
+process_name=%(program_name)s_%(process_num)02d
+numprocs=%(ENV_NUM_WORKERS_DEFAULT)s
+autostart=false
+autorestart=true
+redirect_stderr=false
+stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log
+stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log
+directory=/var/www/MISP
+user=www-data
+
+[program:prio]
+directory=/var/www/MISP
+command=/var/www/MISP/app/Console/cake start_worker prio
+process_name=%(program_name)s_%(process_num)02d
+numprocs=%(ENV_NUM_WORKERS_PRIO)s
+autostart=false
+autorestart=true
+redirect_stderr=false
+stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log
+stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log
+directory=/var/www/MISP
+user=www-data
+
+[program:email]
+directory=/var/www/MISP
+command=/var/www/MISP/app/Console/cake start_worker email
+process_name=%(program_name)s_%(process_num)02d
+numprocs=%(ENV_NUM_WORKERS_EMAIL)s
+autostart=false
+autorestart=true
+redirect_stderr=false
+stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log
+stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log
+directory=/var/www/MISP
+user=www-data
+
+[program:update]
+directory=/var/www/MISP
+command=/var/www/MISP/app/Console/cake start_worker update
+process_name=%(program_name)s_%(process_num)02d
+numprocs=%(ENV_NUM_WORKERS_UPDATE)s
+autostart=false
+autorestart=true
+redirect_stderr=false
+stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log
+stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log
+directory=/var/www/MISP
+user=www-data
+
+[program:cache]
+directory=/var/www/MISP
+command=/var/www/MISP/app/Console/cake start_worker cache
+process_name=%(program_name)s_%(process_num)02d
+numprocs=%(ENV_NUM_WORKERS_CACHE)s
+autostart=false
+autorestart=true
+redirect_stderr=false
+stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log
+stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log
+user=www-data