diff --git a/.context/agents/README.md b/.context/agents/README.md index e29e453..1b6642c 100644 --- a/.context/agents/README.md +++ b/.context/agents/README.md @@ -28,4 +28,5 @@ This directory contains ready-to-customize playbooks for AI agents collaborating - [Documentation Index](../docs/README.md) - [Agent Knowledge Base](../../AGENTS.md) - [Contributor Guidelines](../../CONTRIBUTING.md) +- [Release Blog Post (GLPI 11.0.11)](../../content/en/blog/glpi-11-0-11/index.md) - [Release Blog Post (GLPI 12.0.0-rc1)](../../content/en/blog/glpi-12-0-0-rc1.md) diff --git a/.context/docs/README.md b/.context/docs/README.md index 973e89d..9ac25b9 100644 --- a/.context/docs/README.md +++ b/.context/docs/README.md @@ -5,6 +5,8 @@ Welcome to the repository knowledge base. Start with the project overview, then **Blog Posts Reference** The following blog posts have been added to the documentation index: +- [GLPI 11.0.11: Security Release, Plugin Fixes, and New Features in eftechcombr/glpi](../../content/en/blog/glpi-11-0-11/index.md) (en) — EF-TECH release of GLPI 11.0.11 security release superseding 11.0.10, fixing 6 high vulnerabilities, custom Nginx config templates, and MySQL SSL support +- [GLPI 11.0.11: Release de Segurança, Correção de Plugins e Novos Recursos no eftechcombr/glpi](../../content/pt-br/blog/glpi-11-0-11/index.md) (pt-br) — Lançamento da EF-TECH do GLPI 11.0.11 corrigindo 6 vulnerabilidades de alta severidade, substituindo 11.0.10, templates customizados de Nginx e suporte a SSL no MySQL - [GLPI 12.0.0-rc1 and Helm Chart 2.12.0: Subchart Modernization, Security Hardening, and High Availability](../../content/en/blog/glpi-12-0-0-rc1.md) (en) — EF-TECH release of GLPI 12.0.0-rc1 and Helm Chart 2.12.0 with Valkey subchart, PDB, HPA, S3 backup, and readOnlyRootFilesystem hardening - [GLPI 12.0.0-rc1 e Helm Chart 2.12.0: modernização de subcharts, hardening e alta disponibilidade](../../content/pt-br/blog/glpi-12-0-0-rc1.md) (pt-br) — Lançamento da EF-TECH do GLPI 12.0.0-rc1 e Helm Chart 2.12.0 com subchart Valkey, PDB, HPA, backup S3 e hardening com readOnlyRootFilesystem - [Understanding P99 and Tail Latency](../../content/en/blog/p99-tail-latency/index.md) (en) — Why the mean lies and how to eliminate tail latency bottlenecks in production diff --git a/.context/plans/README.md b/.context/plans/README.md index acdce10..9f391ea 100644 --- a/.context/plans/README.md +++ b/.context/plans/README.md @@ -6,9 +6,10 @@ This directory contains plans for coordinating work across documentation and pla 1. [Add Whatsapp Link](./add-whatsapp-link.md) 2. [Blog Hermes K8s Install](./blog-hermes-k8s-install.md) 3. [Blog Image Support](./blog-image-support.md) -4. [Glpi 12 0 0 Rc1 Announcement](./glpi-12-0-0-rc1-announcement.md) -5. [Oracle Always Free Post](./oracle-always-free-post.md) -6. [Rfc 10008 Blog Post](./rfc-10008-blog-post.md) +4. [GLPI 11.0.11 Announcement](./glpi-11-0-11-announcement.md) +5. [Glpi 12 0 0 Rc1 Announcement](./glpi-12-0-0-rc1-announcement.md) +6. [Oracle Always Free Post](./oracle-always-free-post.md) +7. [Rfc 10008 Blog Post](./rfc-10008-blog-post.md) ## How To Create Or Update Plans - Run "ai-context plan " to scaffold a new plan template. diff --git a/.context/plans/glpi-11-0-11-announcement.md b/.context/plans/glpi-11-0-11-announcement.md new file mode 100644 index 0000000..748b6f2 --- /dev/null +++ b/.context/plans/glpi-11-0-11-announcement.md @@ -0,0 +1,101 @@ +--- +status: active +generated: 2026-10-01 +agents: + - type: "documentation-writer" + role: "Draft comprehensive security announcement blog posts in PT-BR and EN" + - type: "frontend-specialist" + role: "Generate cover PNG image and integrate media into Hugo posts" + - type: "devops-specialist" + role: "Validate Hugo build, link checks, and manage git branch and PR" +docs: + - "project-overview.md" + - "architecture.md" + - "development-workflow.md" +phases: + - id: "phase-1" + name: "Discovery & Alignment" + prevc: "P" + agent: "documentation-writer" + - id: "phase-2" + name: "Implementation & Iteration" + prevc: "E" + agent: "documentation-writer" + - id: "phase-3" + name: "Validation & Handoff" + prevc: "V" + agent: "devops-specialist" +--- + +# GLPI 11.0.11 Security Release Announcement Post Plan + +> Write blog posts in Portuguese and English covering GLPI 11.0.11 security release and EF-TECH Docker/Helm updates, generate cover image, validate build, and create PR. + +## Task Snapshot +- **Primary goal:** Publish announcement blog posts in Portuguese (`content/pt-br/blog/glpi-11-0-11/index.md`) and English (`content/en/blog/glpi-11-0-11/index.md`) covering the GLPI 11.0.11 security release and EF-TECH Docker/Helm updates (PR #209 custom Nginx config, PR #211 base upgrade, PR #207 MySQL SSL support), with a generated featured PNG image and validated links. +- **Success signal:** Clean Hugo production build (`hugo --gc --minify`), no broken images or links, both language versions published, and a clean Git commit / PR created. +- **Key references:** + - [Documentation Index](../docs/README.md) + - [Agent Handbook](../agents/README.md) + - [Plans Index](./README.md) + - [GitHub Repository eftechcombr/glpi](https://github.com/eftechcombr/glpi) + - [Upstream GLPI Releases](https://github.com/glpi-project/glpi/releases) + +## Codebase Context +- **Hugo Site:** Multilingual setup with `pt-br` as default and `en` language section. +- **Blog Post Location:** `content/pt-br/blog/glpi-11-0-11/index.md` and `content/en/blog/glpi-11-0-11/index.md`. +- **Assets:** `static/img/blog/glpi-11-0-11/cover.png` and page bundle `cover.png` generated via Python PIL script. + +## Agent Lineup +| Agent | Role in this plan | Playbook | First responsibility focus | +| --- | --- | --- | --- | +| Documentation Writer | Technical content creation | [Documentation Writer](../agents/documentation-writer.md) | Draft accurate, engaging security release posts in PT-BR and EN | +| Frontend Specialist | Media & Image generation | [Frontend Specialist](../agents/frontend-specialist.md) | Design and generate cover PNG image matching site theme | +| DevOps Specialist | Build & verification | [Devops Specialist](../agents/devops-specialist.md) | Validate Hugo build, verify links, manage git branch and PR | + +## Documentation Touchpoints +| Guide | File | Primary Inputs | +| --- | --- | --- | +| Project Overview | [project-overview.md](../docs/project-overview.md) | Multilingual content structure, blog layout | +| Development Workflow | [development-workflow.md](../docs/development-workflow.md) | Hugo commands, link trailing slash requirements, PR process | + +## Working Phases + +### Phase 1 — Discovery & Alignment +> **Primary Agent:** `documentation-writer` - [Playbook](../agents/documentation-writer.md) + +**Objective:** Inspect release details from `glpi-project/glpi` and `eftechcombr/glpi`, structure the security advisory, and prepare the image generation script. + +**Tasks** +| # | Task | Agent | Status | Deliverable | +|---|------|-------|--------|-------------| +| 1.1 | Analyze GLPI 11.0.11 security advisory, fixed vulnerabilities, and plugin regression context | `documentation-writer` | completed | Content outline | +| 1.2 | Design cover image concept and specifications | `frontend-specialist` | completed | Python PIL generation script | + +--- + +### Phase 2 — Implementation & Iteration +> **Primary Agent:** `documentation-writer` - [Playbook](../agents/documentation-writer.md) + +**Objective:** Generate PNG cover image, author comprehensive blog posts in PT-BR and EN with proper frontmatter, security breakdown, deployment examples, and internal links. + +**Tasks** +| # | Task | Agent | Status | Deliverable | +|---|------|-------|--------|-------------| +| 2.1 | Generate 1200x630 cover PNG at `static/img/blog/glpi-11-0-11/cover.png` and content bundles | `frontend-specialist` | pending | Cover image PNG | +| 2.2 | Author `content/pt-br/blog/glpi-11-0-11/index.md` | `documentation-writer` | pending | Portuguese blog post | +| 2.3 | Author `content/en/blog/glpi-11-0-11/index.md` | `documentation-writer` | pending | English blog post | + +--- + +### Phase 3 — Validation & Handoff +> **Primary Agent:** `devops-specialist` - [Playbook](../agents/devops-specialist.md) + +**Objective:** Validate Hugo build, verify all links and image paths, commit changes, create PR and monitor checks. + +**Tasks** +| # | Task | Agent | Status | Deliverable | +|---|------|-------|--------|-------------| +| 3.1 | Test build with `hugo --gc --minify` | `devops-specialist` | pending | Build verification | +| 3.2 | Check image rendering and link integrity | `devops-specialist` | pending | Verified assets | +| 3.3 | Create git branch, commit, push, create PR and verify CI | `devops-specialist` | pending | Pull Request | diff --git a/content/en/blog/glpi-11-0-11/cover.png b/content/en/blog/glpi-11-0-11/cover.png new file mode 100644 index 0000000..c7bf3af Binary files /dev/null and b/content/en/blog/glpi-11-0-11/cover.png differ diff --git a/content/en/blog/glpi-11-0-11/index.md b/content/en/blog/glpi-11-0-11/index.md new file mode 100644 index 0000000..c2539cb --- /dev/null +++ b/content/en/blog/glpi-11-0-11/index.md @@ -0,0 +1,186 @@ +--- +title: "GLPI 11.0.11: Security Release, Plugin Fixes, and New Features in eftechcombr/glpi" +description: "EF-TECH published Docker images and Helm charts for GLPI 11.0.11, a critical security release superseding 11.0.10, fixing 6 high-severity vulnerabilities, and introducing custom Nginx config templates and MySQL SSL support." +summary: "GLPI 11.0.11 was released on October 1, 2026, as an essential security release that patches 6 high-severity vulnerabilities and immediately supersedes version 11.0.10 to fix a regression in the plugin system. The EF-TECH distribution (eftechcombr/glpi) is now available as Docker images and Helm charts, introducing support for custom Nginx config templates (PR #209) and secure MySQL/MariaDB SSL connections (PR #207)." +date: 2026-10-01 +draft: false +tags: ["glpi", "docker", "kubernetes", "helm", "cloud-native", "security"] +categories: ["infrastructure"] +featureimage: "cover.png" +featureimagecaption: "GLPI 11.0.11 — Docker images and Helm charts with critical security fixes and operational improvements by EF-TECH" +--- + +Today, October 1, 2026, EF-TECH released new Docker images and Helm charts for **GLPI 11.0.11** in the [eftechcombr/glpi](https://github.com/eftechcombr/glpi) repository. This update delivers critical upstream security patches, resolves an urgent regression in the plugin subsystem, and incorporates key operational improvements contributed by EF-TECH and open-source collaborators. + +![GLPI 11.0.11](cover.png) + +## Why GLPI 11.0.11 Supersedes Version 11.0.10 + +A critical detail for system operators and administrators: **GLPI 11.0.11 directly supersedes and replaces version 11.0.10**. + +During the 11.0.10 release cycle, an unexpected regression was introduced that broke plugin loading and execution hooks. Because IT service desks and enterprise setups rely heavily on plugins for inventory synchronization, authentication, and workflow automation, the upstream `glpi-project/glpi` maintainers promptly released version 11.0.11 to rectify this issue alongside high-priority security fixes. + +> **Upgrade Advisory:** If your organization was preparing to deploy version 11.0.10 or is currently running 11.0.9 (or earlier), upgrade directly to **GLPI 11.0.11**. Version 11.0.10 should not be deployed in production environments. + +--- + +## Security Advisory: What Was Fixed + +Officially classified as a **Security Release**, GLPI 11.0.11 fixes a set of severe vulnerabilities that could lead to unauthorized privilege escalation, database compromise, or authentication bypass. + +### High-Severity Vulnerabilities (High) + +1. **Authorization bypass in massive actions**: + Flawed contextual permission checks during bulk item updates allowed operators to execute actions and modify resources outside their authorized scope. +2. **Privilege escalation via user cloning**: + A vulnerability in the account cloning workflow allowed lower-privileged operators to inherit or grant administrative privileges during account duplication. +3. **Improper rights checks in users deletion**: + Missing profile verification when purging or disabling accounts in the user directory. +4. **SQL Injection through form actors dropdown**: + Insufficient sanitization of user-supplied HTTP parameters in the dynamic dropdown selector for form actors, creating a vector for unauthorized SQL queries. +5. **2FA deactivation/modification on users with higher privileges**: + A flaw allowing accounts with standard permissions to modify or disable two-factor authentication (MFA/2FA) on accounts with superior administrative rights. +6. **Reflected XSS in the dashboard search result widget**: + Arbitrary script execution in the browser of operators due to unsanitized search input rendered within the main dashboard widget. + +### Medium-Severity Vulnerabilities (Medium) + +- **Users names enumeration via the planning feature**: + Information disclosure exposing operator logins and names through planning calendar responses. +- **Missing authorization checks in the planning feature**: + Unauthorized viewing and interaction with third-party calendar entries and appointments. + +Given that these vulnerabilities include SQL Injection, 2FA tampering, and privilege escalation, an immediate upgrade is strongly recommended for all production instances. + +--- + +## What's New in the EF-TECH Distribution (`eftechcombr/glpi`) + +Along with upgrading the base image to GLPI 11.0.11 (PR #211 by [@eduardofraga](https://github.com/eduardofraga)), EF-TECH's containerized distribution includes valuable architectural features: + +### 1. Custom Nginx Configuration Template & IPv6 Control (PR #209) + +Contributed by [@ohemelaar-dinum](https://github.com/ohemelaar-dinum), the project now supports supplying a custom Nginx configuration template (`nginx.conf.template`). + +In enterprise environments and Kubernetes clusters where IPv6 is disabled in the host kernel, Nginx's default `listen [::]:80;` directive caused container startup failures: + +```text +nginx: [emerg] bind() to [::]:80 failed (99: Cannot assign requested address) +``` + +With PR #209, operators can customize the Nginx server block or disable the IPv6 listener completely without building a custom image. + +#### Example: Disabling the IPv6 Listener via Custom Template + +When mounting a custom virtualhost template via ConfigMap or Docker volume: + +```nginx +# custom-nginx.conf.template +server { + listen 80 default_server; + # IPv6 listener disabled for clusters without IPv6 support + # listen [::]:80 default_server; + + server_name _; + root /var/www/glpi/public; + + location / { + try_files $uri /index.php$is_args$args; + } + + location ~ ^/index\.php$ { + fastcgi_pass ${GLPI_PHPFPM_HOST}:${GLPI_PHPFPM_PORT}; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } +} +``` + +### 2. Native MySQL / MariaDB SSL/TLS Connection Support (PR #207) + +Introduced during the recent release cycle and fully compatible with 11.0.11, the image supports encrypted database connections over SSL/TLS out of the box. + +This capability is essential when connecting GLPI to managed cloud database services (such as **AWS RDS Aurora MySQL**, **Google Cloud SQL**, or **Azure Database for MySQL**), where encrypted transport (`REQUIRE SSL`) is mandatory. + +Supported environment variables: +- `GLPI_DB_SSL`: Enable or disable SSL mode (`true` or `false`). +- `GLPI_DB_SSL_CA`: Path to the CA certificate bundle. +- `GLPI_DB_SSL_VERIFY`: Enforce strict database certificate verification. + +--- + +## How to Upgrade or Get Started + +### Upgrading via Helm Chart (Kubernetes) + +The official EF-TECH Helm repository is updated with the latest release: + +```bash +# 1. Add or update the EF-TECH Helm repository +helm repo add eftech https://eftechcombr.github.io/glpi/ +helm repo update + +# 2. Upgrade your deployment to GLPI 11.0.11 +helm upgrade --install glpi eftech/glpi \ + --namespace glpi \ + --create-namespace \ + --version 2.11.7 +``` + +### Standalone Docker / Docker Compose + +For standalone container environments: + +```bash +# Pull the stable 11.0.11 container image +docker pull ghcr.io/eftechcombr/glpi:11.0.11 +``` + +Sample `docker-compose.yml` running GLPI 11.0.11 with MariaDB and Nginx: + +```yaml +services: + glpi-fpm: + image: ghcr.io/eftechcombr/glpi:11.0.11 + restart: unless-stopped + environment: + - GLPI_DB_HOST=mariadb + - GLPI_DB_NAME=glpi + - GLPI_DB_USER=glpi + - GLPI_DB_PASSWORD=secret_db_password + - GLPI_DB_SSL=false + volumes: + - glpi_data:/var/www/glpi/files + - glpi_marketplace:/var/www/glpi/marketplace + + glpi-nginx: + image: ghcr.io/eftechcombr/glpi-nginx:11.0.11 + restart: unless-stopped + ports: + - "8080:80" + environment: + - GLPI_PHPFPM_HOST=glpi-fpm + - GLPI_PHPFPM_PORT=9000 + depends_on: + - glpi-fpm + +volumes: + glpi_data: + glpi_marketplace: +``` + +--- + +## Links and References + +- [eftechcombr/glpi GitHub Repository](https://github.com/eftechcombr/glpi) +- [eftechcombr/glpi Releases and Changelog](https://github.com/eftechcombr/glpi/releases) +- [Upstream GLPI 11.0.11 Release Notes](https://github.com/glpi-project/glpi/releases/tag/11.0.11) +- [GLPI on Artifact Hub](https://artifacthub.io/packages/helm/eftech/glpi) +- [EF-TECH Helm Charts Repository](https://eftechcombr.github.io/glpi/) + +--- + +At **EF-TECH**, we specialize in Kubernetes, cloud computing, and infrastructure automation. We design, deploy, and operate high-performance GLPI platforms with enterprise-grade security, observability, and scalability. [Contact us](/en/contato/) to find out how we can support your organization. For more articles like this, visit our [blog](/en/blog/). diff --git a/content/pt-br/blog/glpi-11-0-11/cover.png b/content/pt-br/blog/glpi-11-0-11/cover.png new file mode 100644 index 0000000..c7bf3af Binary files /dev/null and b/content/pt-br/blog/glpi-11-0-11/cover.png differ diff --git a/content/pt-br/blog/glpi-11-0-11/index.md b/content/pt-br/blog/glpi-11-0-11/index.md new file mode 100644 index 0000000..6d23fed --- /dev/null +++ b/content/pt-br/blog/glpi-11-0-11/index.md @@ -0,0 +1,186 @@ +--- +title: "GLPI 11.0.11: Release de Segurança, Correção de Plugins e Novos Recursos no eftechcombr/glpi" +description: "A EF-TECH publicou as imagens Docker e os Helm charts do GLPI 11.0.11, uma release crítica de segurança que substitui a 11.0.10, corrige 6 vulnerabilidades de alta severidade e traz suporte a templates customizados de Nginx e conexões MySQL com SSL." +summary: "O GLPI 11.0.11 foi lançado em 1º de outubro de 2026 como um security release essencial que corrige 6 vulnerabilidades de alta severidade e substitui imediatamente a versão 11.0.10, resolvendo uma regressão no sistema de plugins. A distribuição da EF-TECH (eftechcombr/glpi) já está disponível em contêineres Docker e Helm chart, trazendo novidades como templates customizados para o Nginx (PR #209) e suporte a conexões seguras com MySQL/MariaDB via SSL (PR #207)." +date: 2026-10-01 +draft: false +tags: ["glpi", "docker", "kubernetes", "helm", "cloud-native", "seguranca"] +categories: ["infraestrutura"] +featureimage: "cover.png" +featureimagecaption: "GLPI 11.0.11 — Imagens Docker e Helm charts com correções críticas de segurança e melhorias operacionais pela EF-TECH" +--- + +A EF-TECH disponibilizou hoje, 1º de outubro de 2026, as novas imagens Docker e versões do Helm chart para o **GLPI 11.0.11** no repositório [eftechcombr/glpi](https://github.com/eftechcombr/glpi). Esta atualização traz correções vitais de segurança publicadas pelo projeto upstream, soluciona uma regressão importante no ecossistema de plugins e incorpora melhorias operacionais desenvolvidas pela EF-TECH e pela comunidade de código aberto. + +![GLPI 11.0.11](cover.png) + +## Por que o GLPI 11.0.11 substitui a versão 11.0.10? + +Uma informação fundamental para operadores e administradores de sistemas: **o GLPI 11.0.11 substitui imediatamente a versão 11.0.10**. + +Durante o ciclo de lançamento da versão 11.0.10, foi identificada uma regressão que afetava diretamente o carregamento e os ganchos (*hooks*) do sistema de plugins do GLPI. Para evitar impactos operacionais em ambientes que dependem de extensões ativas de inventário, autenticação ou automação, a equipe upstream do `glpi-project/glpi` publicou de imediato a versão 11.0.11. + +> **Recomendação de atualização:** Se a sua organização estava planejando atualizar para a versão 11.0.10 ou ainda opera na linha 11.0.9 (ou anteriores), atualize diretamente para o **GLPI 11.0.11**. A versão 11.0.10 não deve ser utilizada em produção. + +--- + +## Raio-X de Segurança: O Que Foi Corrigido + +Classificado oficialmente como **Security Release**, o GLPI 11.0.11 mitiga um conjunto de vulnerabilidades severas que poderiam permitir desde o desvio de controles de acesso até a execução indevida de comandos e escalação de privilégios. + +### Vulnerabilidades de Alta Severidade (High) + +1. **Bypass de autorização em ações massivas (*Authorization bypass in massive actions*)**: + Falha na validação de permissões contextuais ao executar ações em lote no GLPI, permitindo que operadores manipulem recursos além das atribuições de seu perfil. +2. **Escalação de privilégios via clonagem de usuários (*Privilege escalation via user cloning*)**: + Brecha no fluxo de clonagem de contas que possibilitava herdar ou atribuir direitos administrativos superiores aos do usuário solicitante. +3. **Checagem inadequada de permissões na exclusão de usuários (*Improper rights checks in users deletion*)**: + Ausência de checagem estrita de perfis no momento de purgar ou desativar contas de usuários no diretório. +4. **Injeção de SQL através do dropdown de atores em formulários (*SQL Injection through form actors dropdown*)**: + Tratamento insuficiente de parâmetros recebidos via requisições HTTP nos seletores dinâmicos de atores de formulários, abrindo vetor para consultas SQL não autorizadas na base de dados. +5. **Modificação ou desativação de 2FA em usuários com privilégios mais altos (*2FA deactivation/modification on users with higher privileges*)**: + Falha que permitia a usuários com permissões intermediárias desabilitar ou alterar o segundo fator de autenticação (MFA/2FA) de contas com nível hierárquico superior. +6. **XSS Refletido no widget de resultados de busca do dashboard (*Reflected XSS in the dashboard search result widget*)**: + Injeção de scripts arbitrários no navegador de operadores através de parâmetros de busca não sanitizados renderizados no painel principal. + +### Vulnerabilidades de Média Severidade (Medium) + +- **Enumeração de nomes de usuários na funcionalidade de planejamento (*Users names enumeration via the planning feature*)**: + Exposição de identificadores de operadores através de respostas inconsistentes em endpoints da agenda. +- **Falta de checagem de autorização no planejamento (*Missing authorization checks in the planning feature*)**: + Permissão indevida para visualizar ou interagir com compromissos de terceiros sem a respectiva permissão de perfil. + +A combinação de vetor SQL Injection com falhas de escalação de privilégios e manipulação de 2FA torna este upgrade indispensável. + +--- + +## Novidades na Distribuição EF-TECH (`eftechcombr/glpi`) + +Além de incorporar o código upstream corrigido (PR #211 por [@eduardofraga](https://github.com/eduardofraga)), o ecossistema de contêineres e Helm charts da EF-TECH traz aprimoramentos arquiteturais relevantes: + +### 1. Template Customizável do Nginx e Controle de IPv6 (PR #209) + +Uma contribuição valiosa de [@ohemelaar-dinum](https://github.com/ohemelaar-dinum) adicionou a flexibilidade de injetar um template de configuração customizado para o Nginx (`nginx.conf.template`). + +Em ambientes corporativos ou clusters Kubernetes onde o suporte a IPv6 está intencionalmente desativado no kernel do host, o listener padrão `listen [::]:80;` causava erros recorrentes de inicialização: + +```text +nginx: [emerg] bind() to [::]:80 failed (99: Cannot assign requested address) +``` + +Com o PR #209, agora é possível fornecer uma configuração customizada ou desabilitar o listener IPv6 de forma simples, garantindo compatibilidade universal de rede sem necessidade de construir uma imagem derivada. + +#### Exemplo: Desabilitando o listener IPv6 via Volume Mount + +Ao executar em contêiner ou via ConfigMap no Kubernetes, você pode montar o seu próprio template de virtualhost: + +```nginx +# custom-nginx.conf.template +server { + listen 80 default_server; + # Listener IPv6 desativado para clusters sem suporte a IPv6 + # listen [::]:80 default_server; + + server_name _; + root /var/www/glpi/public; + + location / { + try_files $uri /index.php$is_args$args; + } + + location ~ ^/index\.php$ { + fastcgi_pass ${GLPI_PHPFPM_HOST}:${GLPI_PHPFPM_PORT}; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } +} +``` + +### 2. Suporte Nativo a Conexões MySQL/MariaDB com SSL/TLS (PR #207) + +Consolidado no ciclo recente e totalmente compatível com o GLPI 11.0.11, o projeto agora oferece suporte nativo para conexões criptografadas com o banco de dados via SSL/TLS. + +Essa funcionalidade é indispensável ao conectar o GLPI a bancos de dados gerenciados em nuvem (como **AWS RDS Aurora MySQL**, **Google Cloud SQL** ou **Azure Database for MySQL**), onde a imposição de conexões criptografadas (`REQUIRE SSL`) é uma política de segurança corporativa mandatória. + +Parâmetros suportados nas variáveis de ambiente: +- `GLPI_DB_SSL`: ativação do modo SSL (`true` ou `false`). +- `GLPI_DB_SSL_CA`: caminho para o certificado da autoridade certificadora (CA). +- `GLPI_DB_SSL_VERIFY`: verificação rigorosa do certificado do servidor de banco. + +--- + +## Como Atualizar ou Experimentar + +### Atualização via Helm Chart (Kubernetes) + +O repositório oficial de Helm charts da EF-TECH já conta com as definições atualizadas: + +```bash +# 1. Adicione ou atualize o repositório Helm da EF-TECH +helm repo add eftech https://eftechcombr.github.io/glpi/ +helm repo update + +# 2. Atualize sua release existente para o GLPI 11.0.11 +helm upgrade --install glpi eftech/glpi \ + --namespace glpi \ + --create-namespace \ + --version 2.11.7 +``` + +### Execução via Docker Standalone / Docker Compose + +Para ambientes baseados em contêineres Docker independentes: + +```bash +# Baixar a imagem estável 11.0.11 +docker pull ghcr.io/eftechcombr/glpi:11.0.11 +``` + +Exemplo básico de `docker-compose.yml` utilizando o GLPI 11.0.11 com MariaDB e Nginx: + +```yaml +services: + glpi-fpm: + image: ghcr.io/eftechcombr/glpi:11.0.11 + restart: unless-stopped + environment: + - GLPI_DB_HOST=mariadb + - GLPI_DB_NAME=glpi + - GLPI_DB_USER=glpi + - GLPI_DB_PASSWORD=secret_db_password + - GLPI_DB_SSL=false + volumes: + - glpi_data:/var/www/glpi/files + - glpi_marketplace:/var/www/glpi/marketplace + + glpi-nginx: + image: ghcr.io/eftechcombr/glpi-nginx:11.0.11 + restart: unless-stopped + ports: + - "8080:80" + environment: + - GLPI_PHPFPM_HOST=glpi-fpm + - GLPI_PHPFPM_PORT=9000 + depends_on: + - glpi-fpm + +volumes: + glpi_data: + glpi_marketplace: +``` + +--- + +## Links e Referências + +- [Repositório eftechcombr/glpi no GitHub](https://github.com/eftechcombr/glpi) +- [Releases e Changelog do eftechcombr/glpi](https://github.com/eftechcombr/glpi/releases) +- [Notas da Release GLPI 11.0.11 Upstream](https://github.com/glpi-project/glpi/releases/tag/11.0.11) +- [GLPI no Artifact Hub](https://artifacthub.io/packages/helm/eftech/glpi) +- [Repositório de Helm Charts da EF-TECH](https://eftechcombr.github.io/glpi/) + +--- + +Na **EF-TECH**, somos especialistas em Kubernetes, cloud computing e automação de infraestrutura. Projetamos, implantamos e operamos ambientes GLPI de alta performance com segurança, observabilidade e escalabilidade. [Entre em contato](/pt-br/contato/) para saber como podemos ajudar sua equipe. Para mais artigos como este, visite nosso [blog](/pt-br/blog/). diff --git a/static/img/blog/glpi-11-0-11/cover.png b/static/img/blog/glpi-11-0-11/cover.png new file mode 100644 index 0000000..c7bf3af Binary files /dev/null and b/static/img/blog/glpi-11-0-11/cover.png differ diff --git a/static/img/blog/glpi-11-0-11/generate_cover.py b/static/img/blog/glpi-11-0-11/generate_cover.py new file mode 100644 index 0000000..655f1a3 --- /dev/null +++ b/static/img/blog/glpi-11-0-11/generate_cover.py @@ -0,0 +1,195 @@ +#!/usr/bin/env python3 +""" +Generate the featured image (1200x630px PNG) for the GLPI 11.0.11 blog post. + +Design: + - Dark navy gradient background (#0c101d -> #18223c) with decorative grid dots + - A terminal window showcasing the pull command, Helm upgrade, and key release features: + * GLPI 11.0.11 security fixes (superseding 11.0.10 and fixing plugin regression) + * Custom Nginx config template with IPv6 toggle (PR #209) + * Database SSL/TLS encryption support (PR #207) + - Big title "GLPI 11.0.11 Security Release", subtitle, and EF-TECH branding + +Requires: pip install pillow +""" + +import os +import sys +import shutil + +try: + from PIL import Image, ImageDraw, ImageFont +except ImportError: + print("Pillow is required. Install it with: pip install pillow") + sys.exit(1) + +WIDTH, HEIGHT = 1200, 630 + + +def find_font(size: int, bold: bool = False, mono: bool = False) -> ImageFont.FreeTypeFont | ImageFont.ImageFont: + """Try to find a suitable font on the system.""" + candidates = [] + if mono: + if bold: + candidates = [ + "/System/Library/Fonts/Supplemental/Courier New Bold.ttf", + "/System/Library/Fonts/Supplemental/PTMono.ttc", + "/System/Library/Fonts/Supplemental/SFNSMono-Bold.otf", + "/usr/share/fonts/truetype/dejavu/DejaVuSansMono-Bold.ttf", + "/usr/share/fonts/truetype/liberation/LiberationMono-Bold.ttf", + ] + else: + candidates = [ + "/System/Library/Fonts/Supplemental/Courier New.ttf", + "/System/Library/Fonts/Supplemental/PTMono.ttc", + "/System/Library/Fonts/Supplemental/Andale Mono.ttf", + "/System/Library/Fonts/Supplemental/SFNSMono-Regular.otf", + "/usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf", + "/usr/share/fonts/truetype/liberation/LiberationMono.ttf", + ] + else: + if bold: + candidates = [ + "/System/Library/Fonts/Supplemental/Arial Bold.ttf", + "/Library/Fonts/Arial Bold.ttf", + "/System/Library/Fonts/Helvetica.ttc", + "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf", + ] + else: + candidates = [ + "/System/Library/Fonts/Supplemental/Arial.ttf", + "/Library/Fonts/Arial.ttf", + "/System/Library/Fonts/Helvetica.ttc", + "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf", + ] + + for path in candidates: + if os.path.exists(path): + try: + return ImageFont.truetype(path, size) + except Exception: + continue + return ImageFont.load_default() + + +def draw_terminal_window(draw: ImageDraw.ImageDraw, x: int, y: int, w: int, h: int) -> None: + """Draw a terminal window with a title bar.""" + shadow_offset = 6 + draw.rounded_rectangle( + [x + shadow_offset, y + shadow_offset, x + w + shadow_offset, y + h + shadow_offset], + radius=14, fill=(0, 0, 0, 90) + ) + # Window body + draw.rounded_rectangle( + [x, y, x + w, y + h], radius=12, fill=(18, 23, 38) + ) + # Title bar + draw.rounded_rectangle( + [x, y, x + w, y + 42], radius=12, fill=(28, 35, 58) + ) + draw.rectangle([x, y + 30, x + w, y + 42], fill=(28, 35, 58)) + + # Traffic light buttons + for cx, color in [(x + 22, (255, 95, 87)), (x + 48, (255, 189, 46)), (x + 74, (39, 201, 63))]: + draw.ellipse([cx, y + 14, cx + 14, y + 28], fill=color) + + font_title = find_font(14, bold=True, mono=True) + draw.text((x + w // 2, y + 21), "eftechcombr/glpi — v11.0.11 (Security Release)", + fill=(180, 195, 225), font=font_title, anchor="mm") + + +def create_featured_image(output_path: str) -> None: + """Create the 1200x630 OG image for the GLPI 11.0.11 post.""" + img = Image.new("RGBA", (WIDTH, HEIGHT), (12, 16, 29, 255)) + draw = ImageDraw.Draw(img) + + # Background gradient #0c101d -> #18223c + top = (12, 16, 29) + bottom = (24, 34, 60) + for i in range(HEIGHT): + t = i / HEIGHT + r = int(top[0] + (bottom[0] - top[0]) * t) + g = int(top[1] + (bottom[1] - top[1]) * t) + b = int(top[2] + (bottom[2] - top[2]) * t) + draw.line([(0, i), (WIDTH, i)], fill=(r, g, b, 255)) + + # Decorative grid dots + for x in range(0, WIDTH, 32): + for y in range(0, HEIGHT, 32): + draw.point((x, y), fill=(70, 90, 140, 50)) + + # Terminal window + tw, th = 980, 360 + tx, ty = (WIDTH - tw) // 2, 28 + draw_terminal_window(draw, tx, ty, tw, th) + + # Terminal text + font_cmd = find_font(15, bold=True, mono=True) + font_out = find_font(14, mono=True) + font_highlight = find_font(14, bold=True, mono=True) + + prompt_x = tx + 32 + line_y = ty + 56 + + draw.text((prompt_x, line_y), "$", fill=(52, 211, 153), font=font_cmd) + draw.text((prompt_x + 18, line_y), " docker pull ghcr.io/eftechcombr/glpi:11.0.11", + fill=(240, 245, 255), font=font_cmd) + line_y += 24 + + draw.text((prompt_x, line_y), "$", fill=(52, 211, 153), font=font_cmd) + draw.text((prompt_x + 18, line_y), " helm upgrade --install glpi eftech/glpi --version 2.11.7", + fill=(240, 245, 255), font=font_cmd) + line_y += 26 + + terminal_lines = [ + ("✔ UPGRADE CRITICAL: GLPI 11.0.11 directly supersedes 11.0.10 (fixes plugins regression)", (248, 113, 113), True), + ("✔ SECURITY: Patches 6 High + 2 Medium CVEs (Auth bypass, PrivEsc, SQLi, XSS)", (251, 191, 36), True), + ("✔ NGINX: Custom template support & IPv6 listener disable option (PR #209)", (56, 189, 248), False), + ("✔ DATABASE: Native MySQL / MariaDB SSL connection support (PR #207)", (56, 189, 248), False), + ("✔ CLOUD-NATIVE: Hardened non-root containers, Valkey caching & S3 backups ready", (148, 163, 184), False), + ("✔ STATUS: Built, tested and published for production workloads", (52, 211, 153), True), + ] + + for text, color, bold in terminal_lines: + f = font_highlight if bold else font_out + draw.text((prompt_x, line_y), text, fill=color, font=f) + line_y += 22 + + # Title section below terminal + title_font = find_font(42, bold=True, mono=False) + draw.text((WIDTH // 2, ty + th + 66), "GLPI 11.0.11 Security Release", + fill=(255, 255, 255), font=title_font, anchor="mm") + + subtitle_font = find_font(21, bold=True, mono=False) + draw.text((WIDTH // 2, ty + th + 118), + "Critical Security Fixes · Plugin System Fix · Custom Nginx · MySQL SSL", + fill=(56, 189, 248), font=subtitle_font, anchor="mm") + + info_font = find_font(15, mono=False) + draw.text((WIDTH // 2, ty + th + 158), + "EF-TECH Cloud-Native Containers & Helm Charts · Production Ready", + fill=(156, 163, 175), font=info_font, anchor="mm") + + # EF-TECH branding + brand_font = find_font(15, bold=True, mono=False) + draw.text((WIDTH - 36, HEIGHT - 22), "EF-TECH", fill=(96, 165, 250), font=brand_font, anchor="rs") + + final = Image.new("RGB", (WIDTH, HEIGHT), (12, 16, 29)) + final.paste(img, mask=img.split()[3]) + final.save(output_path, "PNG") + print(f"Image saved to {output_path} ({WIDTH}x{HEIGHT})") + + +if __name__ == "__main__": + output = os.path.join(os.path.dirname(os.path.abspath(__file__)), "cover.png") + create_featured_image(output) + + # Automatically copy to content bundle folders + repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "..", "..")) + pt_dir = os.path.join(repo_root, "content", "pt-br", "blog", "glpi-11-0-11") + en_dir = os.path.join(repo_root, "content", "en", "blog", "glpi-11-0-11") + os.makedirs(pt_dir, exist_ok=True) + os.makedirs(en_dir, exist_ok=True) + shutil.copyfile(output, os.path.join(pt_dir, "cover.png")) + shutil.copyfile(output, os.path.join(en_dir, "cover.png")) + print("Copied cover.png to pt-br and en content bundles.")