feat(nginx): Make nginx Non-root & Read-only-friendly by kiblik · Pull Request #13384 · DefectDojo/django-DefectDojo

kiblik · 2025-10-08T19:55:11Z

Bumps [cryptography](https://github.com/pyca/cryptography) from 45.0.6 to 45.0.7. - [Changelog](https://github.com/pyca/cryptography/blob/45.0.7/CHANGELOG.rst) - [Commits](pyca/cryptography@45.0.6...45.0.7) --- updated-dependencies: - dependency-name: cryptography dependency-version: 45.0.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [django-dbbackup](https://github.com/Archmonger/django-dbbackup) from 4.3.0 to 5.0.0. - [Release notes](https://github.com/Archmonger/django-dbbackup/releases) - [Changelog](https://github.com/Archmonger/django-dbbackup/blob/master/CHANGELOG.md) - [Commits](Archmonger/django-dbbackup@4.3.0...5.0.0) --- updated-dependencies: - dependency-name: django-dbbackup dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [boto3](https://github.com/boto/boto3) from 1.40.20 to 1.40.21. - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.40.20...1.40.21) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.40.21 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…e.json) (DefectDojo#13085) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…efectDojo#13082) * msteams: Use adaptive cards format * update docs * revert webhook scan_added_empty

…/workflows/pr-labeler.yml) (DefectDojo#13102) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…hub/workflows/validate_docs_build.yml) (DefectDojo#13103) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…ws/test-helm-chart.yml) (DefectDojo#13107) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…se-stale.yml) (DefectDojo#13108) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Bumps [boto3](https://github.com/boto/boto3) from 1.40.21 to 1.40.23. - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.40.21...1.40.23) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.40.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

) * 🎉 Add number of fix_available information to test view * Update dojo/templates/dojo/view_test.html Co-authored-by: valentijnscholten <valentijnscholten@gmail.com> --------- Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>

…ctDojo#13106)

…jo#12900) * test cases: fix caching of system settings * fix tests * fix caching for github * fix caching for github * simplify cache loading * post process only when needed * set tags on (re)import * rebase set tags * reduce save with options * update counts, reduce saves with options * importers: do not save again, but postprocess directly * update counts * optimize hash_code setting * fix counts * set hash code for new findings in reimport * make smaller second save work * make smaller second save work - add no_options * update query counts * improve we_want_async decorator * test performance: force async * fix async stuff in perf test * fix async stuff in perf test * fix async stuff in perf test * update counts * remove logging * perf3b: compute hash_code on first save * fix cve for reimport * ruff * fix no async * Merge remote-tracking branch 'upstream/dev' into perf3-reduce-saves

…0 (.github/workflows/release-3-master-into-dev.yml) (DefectDojo#13111) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…thub/workflows/pr-labeler.yml) (DefectDojo#13113) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Bumps [boto3](https://github.com/boto/boto3) from 1.40.23 to 1.40.24. - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.40.23...1.40.24) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.40.24 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.12.11 to 0.12.12. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.12.11...0.12.12) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.12.12 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [markdown](https://github.com/Python-Markdown/markdown) from 3.8.2 to 3.9. - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](Python-Markdown/markdown@3.8.2...3.9.0) --- updated-dependencies: - dependency-name: markdown dependency-version: '3.9' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pygithub](https://github.com/pygithub/pygithub) from 2.7.0 to 2.8.1. - [Release notes](https://github.com/pygithub/pygithub/releases) - [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst) - [Commits](PyGithub/PyGithub@v2.7.0...v2.8.1) --- updated-dependencies: - dependency-name: pygithub dependency-version: 2.8.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…github/workflows/release-3-master-into-dev.yml) (DefectDojo#13112) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…Dojo#13120) Co-authored-by: Jino Tesauro <jino@defectdojo.com>

* add about_deduplication png * update changelog 2.50 * update changelog 2.50 --------- Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>

* semgrep pro: parse sast finding * update docs

* 🐛 Implement Wazuh v4.8 * update unittests * update * fix * fix * fix * update unittests * update * fix unittest * review

….51.0-2.52.0-dev Release: Merge back 2.51.0 into dev from: master-into-dev/2.51.0-2.52.0-dev

Bumps [django-pghistory](https://github.com/AmbitionEng/django-pghistory) from 3.7.0 to 3.8.3. - [Release notes](https://github.com/AmbitionEng/django-pghistory/releases) - [Changelog](https://github.com/AmbitionEng/django-pghistory/blob/main/CHANGELOG.md) - [Commits](AmbitionEng/django-pghistory@3.7.0...3.8.3) --- updated-dependencies: - dependency-name: django-pghistory dependency-version: 3.8.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…pose.yml) (DefectDojo#13325) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Bumps vulners from 2.3.7 to 3.1.1. --- updated-dependencies: - dependency-name: vulners dependency-version: 3.1.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [social-auth-app-django](https://github.com/python-social-auth/social-app-django) from 5.4.3 to 5.5.1. - [Release notes](https://github.com/python-social-auth/social-app-django/releases) - [Changelog](https://github.com/python-social-auth/social-app-django/blob/master/CHANGELOG.md) - [Commits](python-social-auth/social-app-django@5.4.3...5.5.1) --- updated-dependencies: - dependency-name: social-auth-app-django dependency-version: 5.5.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [jira](https://github.com/pycontribs/jira) from 3.8.0 to 3.10.5. - [Release notes](https://github.com/pycontribs/jira/releases) - [Changelog](https://github.com/pycontribs/jira/blob/main/RELEASE.md) - [Commits](pycontribs/jira@3.8.0...3.10.5) --- updated-dependencies: - dependency-name: jira dependency-version: 3.10.5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…workflows/close-stale.yml) (DefectDojo#13349) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

… v2.4.0 (.github/workflows/release-x-manual-helm-chart.yml) (DefectDojo#13358) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Bumps [boto3](https://github.com/boto/boto3) from 1.40.44 to 1.40.46. - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.40.44...1.40.46) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.40.46 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…jo#13210) * fix: add missing resources, securityContext and env entries * chore: docs and schema * fix: missing securityContext for initializer job * fix: add resources to all cloudsql containers * chore: add missing explicit namespace * chore: refactor, split container and pod security context * chore: docs and schema * fix: lint * chore: sort helper * fix: lint and add changes to release notes * chore: trigger CI * chore: move to 2.52, fix pending issues * chore: docs

Bumps [social-auth-core](https://github.com/python-social-auth/social-core) from 4.7.0 to 4.8.0. - [Release notes](https://github.com/python-social-auth/social-core/releases) - [Changelog](https://github.com/python-social-auth/social-core/blob/master/CHANGELOG.md) - [Commits](python-social-auth/social-core@4.7.0...4.8.0) --- updated-dependencies: - dependency-name: social-auth-core dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ⬆️ Bump ruff from 0.13.2 to 0.13.3 * bump * fix * Update settings.dist.py * Update requirements-lint.txt

Maffooch · 2025-10-10T22:02:40Z

@mtesauro does this fit into your plans for image hardening?

mtesauro · 2025-10-11T16:02:19Z

@mtesauro does this fit into your plans for image hardening?

TBH, I was going to start with the DefectDojo/Django containers first as those are the containers where we have the most code / do the most modifications.

Changing the UID to under the typical 1000+ is interesting but I don't believe it will cause issues for k8s and it also seems that OpenSift has stopped wanting specific UIDs based on this so this shouldn't hurt those using k8s or compose currently as far as I can tell.

mtesauro · 2025-10-11T16:07:46Z

I can test this PR out when it's not a draft as well

github-actions · 2025-10-11T17:24:29Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

kiblik · 2025-10-11T17:54:59Z

I can test this PR out when it's not a draft as well

The current issue with this PR is that as soon as the process tries to modify configs

django-DefectDojo/docker/entrypoint-nginx.sh

Line 24 in 1b338e2

sed -i '/listen \[::\]:/d' "$NGINX_CONFIG"

django-DefectDojo/docker/entrypoint-nginx.sh

Line 28 in 1b338e2

sed -i "s/#stub_status/stub_status/g;" $NGINX_CONFIG

django-DefectDojo/docker/entrypoint-nginx.sh

Line 33 in 1b338e2

sed -i "s/#auth_basic/auth_basic/g;" $NGINX_CONFIG

django-DefectDojo/docker/entrypoint-nginx.sh

Line 36 in 1b338e2

echo "$METRICS_HTTP_AUTH_USER":"$openssl_passwd" >> /etc/nginx/.htpasswd

execution fails (because FS is read-only).

I'm considering creating a separate PR that will be responsible for generating the final config, which will be on a read-write location. It would combine multiple partial definitions of the nginx.conf file. Also, I would like to merge it with nginx_TLS.conf because most of the file is the same.

dependabot bot and others added 30 commits September 3, 2025 09:55

chore(deps): update dependency vite from 7.1.3 to v7.1.4 (docs/packag…

5329068

…e.json) (DefectDojo#13085) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

msteams: Support Power Automate Workflows via Adaptive Card format (D…

2f85b1f

…efectDojo#13082) * msteams: Use adaptive cards format * update docs * revert webhook scan_added_empty

Ruff: Add PLW0603 (DefectDojo#13097)

a47e2b6

🎉 add VAR vulnid (DefectDojo#13096)

e02c26c

chore(deps): update actions/labeler action from v5.0.0 to v6 (.github…

1507f95

…/workflows/pr-labeler.yml) (DefectDojo#13102) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update actions/setup-node action from v4.4.0 to v5 (.git…

5d2a1e6

…hub/workflows/validate_docs_build.yml) (DefectDojo#13103) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Update actions/setup-python action from v5.6.0 to v6 (.github/workflo…

888b6e2

…ws/test-helm-chart.yml) (DefectDojo#13107) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Update actions/stale action from v9.1.0 to v10 (.github/workflows/clo…

8303d5c

…se-stale.yml) (DefectDojo#13108) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

System settings: correct page title/breadcrumbs (DefectDojo#13083)

cec647c

🎉 Add fix_available information to aqua parser DefectDojo#12633 (Defe…

44cbfec

…ctDojo#13106)

uwsgi: default to 4 processes x 4 threads (DefectDojo#13080)

de1f539

fix(product): Drop import_scan_results_prod (DefectDojo#13041)

b6eda47

chore(deps): update actions/github-script action from v7.0.1 to v7.1.…

3d71d77

…0 (.github/workflows/release-3-master-into-dev.yml) (DefectDojo#13111) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update actions/labeler action from v6.0.0 to v6.0.1 (.gi…

774490f

…thub/workflows/pr-labeler.yml) (DefectDojo#13113) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update actions/github-script action from v7.1.0 to v8 (.…

79a292b

…github/workflows/release-3-master-into-dev.yml) (DefectDojo#13112) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

allow qualys hacker guardian parser to parse larger csv files (Defect…

45030d5

…Dojo#13120) Co-authored-by: Jino Tesauro <jino@defectdojo.com>

Update changelog 2.50 (DefectDojo#13121)

8ec84b4

* add about_deduplication png * update changelog 2.50 * update changelog 2.50 --------- Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>

semgrep pro parser (DefectDojo#12848)

7eee818

* semgrep pro: parse sast finding * update docs

🐛 Implement Wazuh v4.8 (DefectDojo#12739)

8e949da

* 🐛 Implement Wazuh v4.8 * update unittests * update * fix * fix * fix * update unittests * update * fix unittest * review

🎉 Add fix_available information to jfrog (DefectDojo#13115)

7d3b999

DefectDojo release bot and others added 14 commits October 6, 2025 18:09

Update versions in application files

b976db2

Merge pull request DefectDojo#13355 from DefectDojo/master-into-dev/2…

3352897

….51.0-2.52.0-dev Release: Merge back 2.51.0 into dev from: master-into-dev/2.51.0-2.52.0-dev

Update redis:7.2.11-alpine Docker digest from 7.2.11 to v (docker-com…

405ac92

…pose.yml) (DefectDojo#13325) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update actions/stale action from v9.1.0 to v10 (.github/…

b662f13

…workflows/close-stale.yml) (DefectDojo#13349) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update softprops/action-gh-release action from v2.3.4 to…

ea8b74d

… v2.4.0 (.github/workflows/release-x-manual-helm-chart.yml) (DefectDojo#13358) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(helm): Fix checker of HELM chart change (DefectDojo#13310)

2da05de

⬆️ Bump ruff from 0.13.2 to 0.14.0 (DefectDojo#13337)

eb3c83a

* ⬆️ Bump ruff from 0.13.2 to 0.13.3 * bump * fix * Update settings.dist.py * Update requirements-lint.txt

github-actions bot added the docker label Oct 8, 2025

kiblik force-pushed the nginx_readonly branch from 72fbcf1 to bc958dc Compare October 8, 2025 21:07

github-actions bot added the helm label Oct 8, 2025

kiblik force-pushed the nginx_readonly branch 3 times, most recently from 3352df0 to f02448f Compare October 8, 2025 21:14

feat(nginx): Make nginx Read-only-friendly

91c04e3

kiblik force-pushed the nginx_readonly branch from f02448f to 91c04e3 Compare October 8, 2025 21:36

github-actions bot added the conflicts-detected label Oct 11, 2025

Maffooch added the pending-closure label Feb 10, 2026

Maffooch force-pushed the dev branch from 595c226 to ad53d73 Compare February 16, 2026 17:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(nginx): Make nginx Non-root & Read-only-friendly#13384

feat(nginx): Make nginx Non-root & Read-only-friendly#13384
kiblik wants to merge 10000 commits intoDefectDojo:devfrom
kiblik:nginx_readonly

kiblik commented Oct 8, 2025

Uh oh!

Maffooch commented Oct 10, 2025

Uh oh!

mtesauro commented Oct 11, 2025

Uh oh!

mtesauro commented Oct 11, 2025

Uh oh!

github-actions bot commented Oct 11, 2025

Uh oh!

kiblik commented Oct 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

Conversation

kiblik commented Oct 8, 2025

Uh oh!

Maffooch commented Oct 10, 2025

Uh oh!

mtesauro commented Oct 11, 2025

Uh oh!

mtesauro commented Oct 11, 2025

Uh oh!

github-actions bot commented Oct 11, 2025

Uh oh!

kiblik commented Oct 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants