fix(wordpress): move to PHP 8.5.12 for PHP2Shell

CVE-2026-109618 and CVE-2026-109619 (BSI BITS-H 2026-297981-1132) allow unauthenticated RCE on every PHP before 8.5.12/8.4.27/8.3.36/8.2.35; mod_php is the highest-risk variant. The running pod reports PHP 8.3.35 and www.renner.uno serves / to the internet without the Authentik gate. Switch to the php8.5-apache variant of the same WordPress release, pinned to the index digest rebuilt on 2026-10-22 after the PHP fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-22 11:57:02 +02:00
4 changed files with 12 additions and 17 deletions
@@ -21,13 +21,10 @@ data:
      the pod's default route — which players on the IoT VLAN cannot route to.
      The v30iot address lives on the net1 macvlan child (see
      network-attachment.yaml).
-    - bind_ip must be the same live v30iot address. aiosendspin starts its
-      zeroconf on [bind_ip], or on InterfaceChoice.Default for 0.0.0.0; Default
-      sends mDNS queries via the main-table default route (eth0, net1 routes
-      live in the sbr table), so MA never queries the IoT VLAN for
-      _sendspin._tcp and Voice PEs are only rediscovered when they announce
-      on their own. The Sendspin server has no all-interfaces bind fallback, so
-      bind_ip must be local at start; it is, because it is read from net1 here.
+    - bind_ip must be 0.0.0.0. The Sendspin server (aiosendspin, port 8927) has
+      NO all-interfaces fallback: if bind_ip is a specific IP that is not local
+      it fails to bind and the server never starts, and its proxy then targets
+      that dead IP instead of 127.0.0.1. Binding 0.0.0.0 avoids both.

    The v30iot IP is DHCP and node-dependent (MA is not node-pinned), so a stored
    IP is a stale assumption the moment MA reschedules or the lease changes -
@@ -94,15 +91,15 @@ data:
            .setdefault("values", {})
        )
        old_pub, old_bind = values.get("publish_ip"), values.get("bind_ip")
-        if (old_pub, old_bind) == (ip, ip):
+        if (old_pub, old_bind) == (ip, "0.0.0.0"):
            print("[reconcile] publish_ip/bind_ip already correct; no change")
            return 0

        values["publish_ip"] = ip
-        values["bind_ip"] = ip
+        values["bind_ip"] = "0.0.0.0"
        print(
            f"[reconcile] publish_ip {old_pub!r} -> {ip!r}, "
-            f"bind_ip {old_bind!r} -> {ip!r}"
+            f"bind_ip {old_bind!r} -> '0.0.0.0'"
        )

        tmp = SETTINGS + ".reconcile.tmp"
@@ -44,9 +44,7 @@ spec:
        #     which IoT players can't reach; and
        #   - net1 is DHCP and MA is not node-pinned, so any hard-coded IP goes
        #     stale on the next reschedule or lease change (the Sendspin server
-        #     then fails to bind and dies, with no fallback); and
-        #   - a 0.0.0.0 bind_ip makes Sendspin's mDNS browse query via eth0, so
-        #     Voice PEs on the IoT VLAN are not rediscovered after a restart.
+        #     then fails to bind and dies, with no fallback).
        # So we recompute the v30iot IP from the live interface every boot and
        # write it into /data/settings.json before MA reads it. Multus attaches
        # net1 (with its DHCP lease) before any container runs, so this sees the
@@ -13,9 +13,9 @@
 # initContainer (configmap-net-reconcile.yaml) discovers net1's leased
 # address the same way it used to discover the host's ens19 address —
 # scanning the pod's own interfaces for a 10.2.30.0/24 address — and
-# writes it as MA's publish_ip and bind_ip; players reach the
-# stream/sendspin servers on net1. Requires the cni-dhcp-daemon DaemonSet
-# in infrastructure/multus.
+# writes it as MA's publish_ip. bind_ip stays 0.0.0.0, which now binds
+# eth0 (pod) + net1; players reach the stream/slimproto/sendspin servers
+# on net1. Requires the cni-dhcp-daemon DaemonSet in infrastructure/multus.
 #
 # Mirrors matter-server-iot; the only difference is MA does not speak
 # Thread, so the matter NAD's accept_ra_rt_info_max_plen tuning (for the
@@ -25,7 +25,7 @@ spec:
        fsGroup: 33
      containers:
        - name: wordpress
-          image: wordpress:7.1.3-php8.3-apache@sha256:8ecd8d8e374167ea22235acf30f80d1165b82f07ffa5bcef90c1cad8f7be251f
+          image: wordpress:7.1.3-php8.5-apache@sha256:ce31904fa1e51b73543fa2e35cc8f1747589b2abf48dc747b422749b88b77e9e
          ports:
            - name: http
              containerPort: 80