bjorne/reflector-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

INSTALL.md: keep exec() enabled in the default pool (node pages and CSR parsing use it), add openssl package, describe empty dashboard without the API

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
bjorne
2026-09-26 23:36:18 +02:00
co-authored by Claude Fable 5.1
parent d18a0f0b91
commit 5c6f112abd
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
INSTALL.md
+15 -8
View File
@@ -26,7 +26,7 @@ everywhere you see it.
## 1. Packages ## 1. Packages
```bash ```bash
sudo apt install nginx php8.4-fpm php8.4-redis php8.4-mbstring php8.4-cli redis-server certbot sudo apt install nginx php8.4-fpm php8.4-redis php8.4-mbstring php8.4-cli redis-server certbot openssl
``` ```
Check the PHP version you actually got (`php -v`) and use that number instead Check the PHP version you actually got (`php -v`) and use that number instead
@@ -75,22 +75,26 @@ redis-cli -s /run/redis-svxportal/redis.sock -a 'PASTE-THE-VALUE-HERE' ping #
## 4. PHP-FPM ## 4. PHP-FPM
Two pools are used. The default pool (`www`) handles all normal pages. A Two pools are used. The default pool (`www`) handles all normal pages. A
second small pool handles only `auth/admin_reflector_api.php`, because that second small pool handles only `auth/admin_reflector_api.php`, so its longer
script calls `exec()` to reach the sudo helpers (step 9) and you do not want timeout and separate process limits do not affect the rest of the site.
`exec()` enabled for the whole site.
```bash ```bash
sudo cp install/php-fpm-svxadmin.conf /etc/php/8.4/fpm/pool.d/svxadmin.conf sudo cp install/php-fpm-svxadmin.conf /etc/php/8.4/fpm/pool.d/svxadmin.conf
``` ```
In the default pool hardening is recommended. Edit Hardening of the default pool is recommended. Edit
`/etc/php/8.4/fpm/pool.d/www.conf` and add at the end: `/etc/php/8.4/fpm/pool.d/www.conf` and add at the end:
```ini ```ini
php_admin_value[disable_functions] = exec,passthru,shell_exec,system,popen,proc_open,proc_close,pcntl_exec,dl,phpinfo,show_source php_admin_value[disable_functions] = passthru,shell_exec,system,popen,proc_open,proc_close,pcntl_exec,dl,phpinfo,show_source
php_admin_value[expose_php] = Off php_admin_value[expose_php] = Off
``` ```
Do **not** add `exec` to that list. The portal uses `exec()` in the default
pool too: `openssl req` to read the e-mail out of a pending CSR, and the sudo
helpers from the node pages (`auth/node_auth_api.php`, `auth/node_cmd_api.php`,
`auth/admin_nodes.php`). With `exec` disabled those pages return errors.
Then: Then:
```bash ```bash
@@ -228,8 +232,11 @@ Log in on the web page with that callsign. The **Admin** menu appears.
The dashboard (node list, map, monitor, last-heard, trunks) fetches JSON and The dashboard (node list, map, monitor, last-heard, trunks) fetches JSON and
Server-Sent Events from `/svxportal/api/...`, which nginx proxies to Server-Sent Events from `/svxportal/api/...`, which nginx proxies to
`127.0.0.1:8098`. That backend service is **not included** here. Without it `127.0.0.1:8098`. That backend service is **not included** here. Without it
the account/admin/talkgroup pages work, but the live node views stay empty the account/admin/talkgroup pages work, but the front page's node list, map,
(the page shows a connection error banner). monitor, last-heard and trunks views simply stay **empty**. There is no error
banner: the API helper returns null on a failed fetch and the page keeps its
empty tables. Check the browser console (404 on `/svxportal/api/status`) if
you are unsure.
Endpoints the UI expects: Endpoints the UI expects: