Add MEDIAWIKI_PROXY_SERVERS setting

to MW only seeing the internal docker networking addresses for incoming
traffic.

LocalSettings.php.tmpl

@@ -120,6 +120,13 @@ $wgGroupPermissions['*']['read'] = false;
 $wgGroupPermissions['*']['read'] = true;
 {{ end }}
 
+{{ if ne (env "MEDIAWIKI_PROXY_SERVERS") "" }}
+// In LocalSettings.php
+$wgUseCdn = true;
+$wgCdnServersNoPurge = [];
+$wgCdnServersNoPurge[] = "{{ env "MEDIAWIKI_PROXY_SERVERS" }}";
+{{ end }}
+
 # Enabled skins.
 # The following skins were automatically enabled:
 wfLoadSkin( 'MonoBook' );
@@ -248,3 +255,15 @@ $wgFileExtensions = array(
 
 $wgUploadSizeWarning = 1000000000;
 $wgMaxUploadSize = 1000000000;
+
+# Greatly relax IP-based throttling for logging in while we work around docker networking issues.
+# https://social.coop/@flancian/110980993608947217
+$wgPasswordAttemptThrottle = [
+	// Short term limit
+	[ 'count' => 9999, 'seconds' => 300 ],
+	// Long term limit. We need to balance the risk
+	// of somebody using this as a DoS attack to lock someone
+	// out of their account, and someone doing a brute force attack.
+	[ 'count' => 999999, 'seconds' => 60 * 60 * 48 ],
+];
+

abra.sh

@@ -1,4 +1,4 @@
-export LOCAL_SETTINGS_CONF_VERSION=v22
+export LOCAL_SETTINGS_CONF_VERSION=v25
 export HTACCESS_CONF_VERSION=v1
 export ENTRYPOINT_CONF_VERSION=v20
 export COMPOSER_LOCAL_CONF_VERSION=v5