/compose.yaml — * see docs/ARCHITECTURE.md; this mirrors how autostart/networks/backups * are all rooted under /boot/config/plugins/podman/ for the same * boot-persistence reasons. * * Actions (?action=...): * list GET -> known projects with up/down status * get GET (&project=...) -> raw compose.yaml content * up POST {"project": "..."} * down POST {"project": "..."} * pull POST {"project": "..."} */ declare(strict_types=1); require __DIR__ . '/../include/bootstrap.php'; $composeDir = $podmanConfig->bootDir . '/compose'; $action = $_GET['action'] ?? ''; switch ($action) { case 'list': podman_json_response(compose_list($composeDir)); break; case 'get': $project = (string) ($_GET['project'] ?? ''); podman_json_response(['yaml' => compose_read($composeDir, $project)]); break; case 'up': podman_json_response(compose_run($composeDir, require_project(podman_read_json_body()), ['up', '-d'])); break; case 'down': podman_json_response(compose_run($composeDir, require_project(podman_read_json_body()), ['down'])); break; case 'pull': podman_json_response(compose_run($composeDir, require_project(podman_read_json_body()), ['pull'])); break; default: podman_json_error("Unknown action '{$action}'", 400); } /** @param array $body */ function require_project(array $body): string { $project = (string) ($body['project'] ?? ''); if (!is_valid_project_name($project)) { podman_json_error('Missing or invalid project name', 400); } return $project; } /** * Project names come from the user (a form field when creating a new * compose project, or a value round-tripped from list()). Restricting * them to a fixed safe character set here — BEFORE they're ever used to * build a filesystem path or a command argument — is what makes it safe * to pass them to proc_open() at all. */ function is_valid_project_name(string $name): bool { return $name !== '' && preg_match('/^[a-zA-Z0-9_-]+$/', $name) === 1; } /** @return array> */ function compose_list(string $composeDir): array { if (!is_dir($composeDir)) { return []; } $projects = []; foreach (scandir($composeDir) ?: [] as $entry) { if ($entry === '.' || $entry === '..' || !is_valid_project_name($entry)) { continue; } $yamlPath = $composeDir . '/' . $entry . '/compose.yaml'; if (!is_file($yamlPath)) { continue; } $projects[] = [ 'name' => $entry, 'path' => $yamlPath, 'status' => compose_status($composeDir, $entry), ]; } usort($projects, static fn($a, $b) => strcmp($a['name'], $b['name'])); return $projects; } /** Best-effort "up"/"down" status via `podman compose ps`; degrades to "unknown" rather than failing the whole list. */ function compose_status(string $composeDir, string $project): string { $result = run_compose_command($composeDir, $project, ['ps', '--format', 'json'], 5); if ($result['exitCode'] !== 0) { return 'unknown'; } $decoded = json_decode($result['output'], true); return (is_array($decoded) && count($decoded) > 0) ? 'up' : 'down'; } function compose_read(string $composeDir, string $project): string { if (!is_valid_project_name($project)) { podman_json_error('Invalid project name', 400); } $path = $composeDir . '/' . $project . '/compose.yaml'; $content = is_file($path) ? file_get_contents($path) : false; if ($content === false) { podman_json_error("compose.yaml not found for project '{$project}'", 404); } return $content; } /** @return array */ function compose_run(string $composeDir, string $project, array $subcommand): array { $result = run_compose_command($composeDir, $project, $subcommand, 300); if ($result['exitCode'] !== 0) { podman_json_error("podman compose " . implode(' ', $subcommand) . " failed:\n" . $result['output'], 502); } return ['output' => $result['output']]; } /** * Runs `podman compose -f /compose.yaml ` via * proc_open with an argv array (never a shell string — proc_open with an * array argument bypasses the shell entirely, so there is no injection * surface even though $project has already been validated above too). * * @param array $subcommand * @return array{exitCode:int,output:string} */ function run_compose_command(string $composeDir, string $project, array $subcommand, int $timeoutSeconds): array { $yamlPath = $composeDir . '/' . $project . '/compose.yaml'; $argv = array_merge(['podman', 'compose', '-f', $yamlPath], $subcommand); $descriptors = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']]; $process = proc_open($argv, $descriptors, $pipes, $composeDir . '/' . $project); if (!is_resource($process)) { return ['exitCode' => 127, 'output' => 'Could not start podman compose process']; } stream_set_timeout($pipes[1], $timeoutSeconds); $stdout = stream_get_contents($pipes[1]) ?: ''; $stderr = stream_get_contents($pipes[2]) ?: ''; fclose($pipes[1]); fclose($pipes[2]); $exitCode = proc_close($process); return ['exitCode' => $exitCode, 'output' => trim($stdout . $stderr)]; }