From 436655509e40b7cb241cbb76da35c94f24745ed6 Mon Sep 17 00:00:00 2001
From: bkb <bkb@arcnode.xyz>
Date: Wed, 11 Mar 2026 10:01:08 -0500
Subject: [PATCH] Switch Docker image from Apache to nginx+php-fpm alpine

---
 Dockerfile           | 27 +++++++++++++--------------
 docker/entrypoint.sh |  4 ++++
 docker/nginx.conf    | 37 +++++++++++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+), 14 deletions(-)
 create mode 100644 docker/entrypoint.sh
 create mode 100644 docker/nginx.conf

diff --git a/Dockerfile b/Dockerfile
index 6e1e01e..85dc259 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,32 +1,31 @@
-FROM php:8.3-apache
+FROM php:8.3-fpm-alpine
 
-# Enable mod_rewrite
-RUN a2enmod rewrite
+# Install nginx
+RUN apk add --no-cache nginx
 
 # Create log and state directories
-RUN mkdir -p /var/lib/wp-honeypot \
+RUN mkdir -p /var/lib/wp-honeypot /run/nginx \
     && touch /var/log/wp-honeypot.log /var/log/wp-honeypot-intel.jsonl \
     && chown www-data:www-data /var/lib/wp-honeypot /var/log/wp-honeypot.log /var/log/wp-honeypot-intel.jsonl \
     && chmod 700 /var/lib/wp-honeypot \
     && chmod 640 /var/log/wp-honeypot.log /var/log/wp-honeypot-intel.jsonl
 
+# Copy nginx config
+COPY docker/nginx.conf /etc/nginx/http.d/default.conf
+
 # Copy trap files
 COPY trap/wp-trap.php /var/www/html/wp-trap.php
 COPY trap/wp-trap-config.php /var/www/html/wp-trap-config.php
-COPY apache/honeypot-rewrite.conf /tmp/honeypot-rewrite.conf
-
-# Build .htaccess from rewrite rules
-RUN cp /tmp/honeypot-rewrite.conf /var/www/html/.htaccess \
-    && rm /tmp/honeypot-rewrite.conf
 
-# Apache: allow .htaccess overrides
-RUN sed -i '/<Directory \/var\/www\/>/,/<\/Directory>/ s/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf
+# Copy dashboard
+COPY tools/dashboard.php /var/www/html/dashboard/index.php
 
 # Set ownership
 RUN chown -R www-data:www-data /var/www/html
 
-# Optional: copy dashboard
-COPY tools/dashboard.php /var/www/html/dashboard/index.php
-RUN chown -R www-data:www-data /var/www/html/dashboard
+# Entrypoint: run php-fpm + nginx
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
 EXPOSE 80
+CMD ["/entrypoint.sh"]
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
new file mode 100644
index 0000000..4e90303
--- /dev/null
+++ b/docker/entrypoint.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+# Start php-fpm in the background, then nginx in the foreground
+php-fpm -D
+nginx -g 'daemon off;'
diff --git a/docker/nginx.conf b/docker/nginx.conf
new file mode 100644
index 0000000..a959e23
--- /dev/null
+++ b/docker/nginx.conf
@@ -0,0 +1,37 @@
+server {
+    listen 80;
+    server_name _;
+    root /var/www/html;
+    index index.php;
+
+    # Block access to config file
+    location = /wp-trap-config.php {
+        return 403;
+    }
+
+    # Honeypot rewrites: route wp-login.php and wp-admin to trap
+    # Only if the visitor doesn't have a valid WordPress session cookie
+    location = /wp-login.php {
+        if ($http_cookie !~* "wordpress_logged_in_") {
+            rewrite ^ /wp-trap.php last;
+        }
+        try_files $uri =404;
+    }
+
+    location = /wp-admin {
+        if ($http_cookie !~* "wordpress_logged_in_") {
+            rewrite ^ /wp-trap.php last;
+        }
+        try_files $uri =404;
+    }
+
+    location ~ \.php$ {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}
-- 
2.51.2