Stack docker-compose Roundcube 1.7.4 (nginx, php-fpm, MariaDB) avec skin vBlog.io

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sa4nUG3GtbdEaPS6fA8eq1

nginx/templates/default.conf.template

@@ -0,0 +1,65 @@
+# Roundcube 1.7 : seul public_html/ est exposé (index.php, static.php).
+# Les ressources statiques sont référencées en /static.php/<chemin> ; nginx les
+# sert directement depuis le volume partagé et ne délègue à PHP que le reste.
+
+upstream roundcube_fpm {
+    server ${NGINX_PHP_FPM};
+}
+
+server {
+    listen 80 default_server;
+    server_name _;
+
+    root /var/www/html/public_html;
+    index index.php;
+
+    client_max_body_size ${NGINX_CLIENT_MAX_BODY_SIZE};
+    server_tokens off;
+
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "same-origin" always;
+
+    # Statique servi par nginx (même liste de préfixes que ALLOWED_PATHS de static.php)
+    location ~ ^/static\.php/((?:skins|plugins|program/js|program/resources)/.+\.(?:css|js|map|png|gif|jpe?g|svg|ico|webp|avif|woff2?|ttf|eot|html|json))$ {
+        alias /var/www/html/$1;
+        expires 30d;
+        add_header X-Content-Type-Options "nosniff" always;
+        access_log off;
+    }
+
+    location = /favicon.ico {
+        alias /var/www/html/skins/elastic/images/favicon.ico;
+        access_log off;
+    }
+
+    # Points d'entrée PHP autorisés (installer.php volontairement exclu)
+    location ~ ^/(?:index|static)\.php(?:/|$) {
+        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_param HTTP_PROXY "";
+        fastcgi_pass roundcube_fpm;
+        fastcgi_read_timeout 300s;
+    }
+
+    # Healthcheck : ping du pool php-fpm, local uniquement
+    location = /fpm-ping {
+        allow 127.0.0.1;
+        deny all;
+        access_log off;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_NAME /fpm-ping;
+        fastcgi_param SCRIPT_FILENAME /fpm-ping;
+        fastcgi_pass roundcube_fpm;
+    }
+
+    location = / {
+        rewrite ^ /index.php last;
+    }
+
+    # Tout le reste (installer.php, fichiers cachés...) : refusé
+    location / {
+        return 404;
+    }
+}