wordpress 6.4.1 and mariadb 11.2

Reviewed-on: #33

.drone.yml

@@ -3,7 +3,7 @@ kind: pipeline
 name: deploy to swarm-test.autonomic.zone
 steps:
   - name: deployment
-    image: decentral1se/stack-ssh-deploy:latest
+    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
     settings:
       host: swarm-test.autonomic.zone
       stack: wordpress
@@ -11,6 +11,8 @@ steps:
       purge: true
       deploy_key:
         from_secret: drone_ssh_swarm_test
+      networks:
+        - proxy
     environment:
       DOMAIN: wordpress.swarm-test.autonomic.zone
       STACK_NAME: wordpress

.env.sample

@@ -1,10 +1,30 @@
 TYPE=wordpress
+TIMEOUT=300
+ENABLE_AUTO_UPDATE=true
+COMPOSE_FILE="compose.yml"
 
 DOMAIN=wordpress.example.com
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.wordpress.example.com`'
 LETS_ENCRYPT_ENV=production
 
+# Setup Wordpress settings on each deploy:
+#POST_DEPLOY_CMDS="app core_install"
+
+# Optional settings, otherwise can be set in the installer
+# (Required for `app core_install`
+#TITLE="My Example Blog"
+#LOCALE="en_US" # de_DE
+#ADMIN_EMAIL=admin@example.com
+
+# Every new user is per default subscriber, uncomment to change it
+#DEFAULT_USER_ROLE=administrator
+
+# PHP composer for plugin installation
+#COMPOSE_FILE="$COMPOSE_FILE:compose.composer.yml"
+
+#WORDPRESS_DEBUG=true
+
 ## Additional extensions
 #PHP_EXTENSIONS="calendar"
 
@@ -16,22 +36,39 @@ SECRET_DB_PASSWORD_VERSION=v1
 
 # Multisite
 #WORDPRESS_CONFIG_EXTRA="\
-#	define('WP_CACHE', false);\
+#define('WP_CACHE', false);\
-#	define('WP_ALLOW_MULTISITE', true );"
+#define('WP_ALLOW_MULTISITE', true );"
 
 # Multisite phase 2 (see README)
-# WORDPRESS_CONFIG_EXTRA="define('MULTISITE', true); define('SUBDOMAIN_INSTALL', true); define('DOMAIN_CURRENT_SITE', '${DOMAIN}'); define('PATH_CURRENT_SITE', '/');	define('SITE_ID_CURRENT_SITE', 1); define('BLOG_ID_CURRENT_SITE', 1); define('FORCE_SSL_ADMIN', true ); define('COOKIE_DOMAIN', \$_SERVER['HTTP_HOST']);"
+#WORDPRESS_CONFIG_EXTRA="define('MULTISITE', true); define('SUBDOMAIN_INSTALL', true); define('DOMAIN_CURRENT_SITE', '${DOMAIN}'); define('PATH_CURRENT_SITE', '/');	define('SITE_ID_CURRENT_SITE', 1); define('BLOG_ID_CURRENT_SITE', 1); define('FORCE_SSL_ADMIN', true ); define('COOKIE_DOMAIN', \$_SERVER['HTTP_HOST']);"
 
 # Local SMTP relay
-#COMPOSE_FILE="compose.yml:compose.mailrelay.yml"
+#COMPOSE_FILE="$COMPOSE_FILE:compose.mailrelay.yml"
 #SMTP_HOST="postfix_relay_app"
 #MAIL_FROM="wordpress@example.com"
 
 # Remote SMTP relay
-#COMPOSE_FILE="compose.yml:compose.mailrelay.yml:compose.smtp.yml"
+#COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
 #SMTP_HOST="mail.example.com"
 #MAIL_FROM="wordpress@example.com"
+#SMTP_USER="wordpress@example.com"  # optional, defaults to MAIL_FROM
+#SMTP_OVERRIDE_FROM=on  # force "From" to MAIL_FROM, usually necessary
 #SMTP_PORT=587
 #SMTP_AUTH=on
 #SMTP_TLS=on
 #SECRET_SMTP_PASSWORD_VERSION=v1
+
+# Authentik SSO
+#COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
+#AUTHENTIK_DOMAIN=authentik.example.com
+#SECRET_AUTHENTIK_SECRET_VERSION=v1
+#SECRET_AUTHENTIK_ID_VERSION=v1
+#LOGIN_TYPE='auto'
+
+# Allow remote connections to db
+# 🚩🚩 dangerous, use only for development sites!
+#COMPOSE_FILE="$COMPOSE_FILE:compose.public-db.yml
+
+# Wide-open CORS
+# 🚩🚩 dangerous, use only for development sites!
+#CORS_ALLOW_ALL=1

README.md

@@ -1,6 +1,6 @@
 # Wordpress
 
-[![Build Status](https://drone.autonomic.zone/api/badges/coop-cloud/wordpress/status.svg)](https://drone.autonomic.zone/coop-cloud/wordpress)
+[![Build Status](https://build.coopcloud.tech/api/badges/coop-cloud/wordpress/status.svg)](https://build.coopcloud.tech/coop-cloud/wordpress)
 
 Coöp Cloud + [Wordpress](https://wordpress.org) = 🥳
 
@@ -17,40 +17,51 @@ Coöp Cloud + [Wordpress](https://wordpress.org) = 🥳
 
 <!-- endmetadata -->
 
-## Basic usage
 
-1. Set up Docker Swarm and [`abra`][abra]
+## Quick start
-2. Deploy [`coop-cloud/traefik`][cc-traefik]
+
-3. `abra app new wordpress --secrets` (optionally with `--pass` if you'd like
+
-   to save secrets in `pass`)
+* `abra app new wordpress`
-4. `abra app YOURAPPDOMAIN config` - be sure to change `$DOMAIN` to something that resolves to
+* `abra app config <app-name>`
-   your Docker swarm box
+* `abra app secret generate -a <app-name>`
-5. `abra app YOURAPPDOMAIN deploy`
+* `abra app deploy <app-name>`
-6. Open the configured domain in your browser to finish set-up
+* `abra app cmd <app-name> app core_install`
-7. `abra app YOURAPPDOMAIN run app chown www-data:www-data /var/www/html/wp-content` to fix
+
-   file permissions (see #3)
+### Authentik Integration
+
+
+`abra app config <app-name>` 
+Configure the following envs:
+```
+COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
+AUTHENTIK_DOMAIN=authentik.example.com
+AUTHENTIK_SECRET_NAME=authentik_example_com_wordpress_secret_v1  # the same as in authentik
+AUTHENTIK_ID_NAME=authentik_example_com_wordpress_id_v1  # the same as in authentik
+```
+
+`abra app cmd <app-name> app set_authentik`
 
 ## Running WP-CLI
 
-`abra app cmd YOURAPPDOMAIN app wp -- core check-update --major`
+`abra app cmd <app-name> app wp -- core check-update --major`
 
 ## Network (Multi-site)
 
 _(Only tested using subdomains)_
 
 1. Set up as above
-2. `abra app YOURAPPDOMAIN config`, and uncomment the first `# Multisite` section
+2. `abra app config <app-name>`, and uncomment the first `# Multisite` section
-3. `abra app YOURAPPDOMAIN deploy`
+3. `abra app deploy <app-name>`
 4. Log into the Wordpress admin dashboard, go to Tools » Network Setup
 5. Don't worry about the suggested file changes
-6. `abra app YOURAPPDOMAIN config` again - comment out the first `# Multisite`
+6. `abra app config <app-name>` again - comment out the first `# Multisite`
    section in `.envrc`, uncomment the `# Multisite phase 2` section, and add
    your multisite subdomain(s) to `EXTRA_DOMAINS` (beware the weird syntax..)
-7. `abra app YOURAPPDOMAIN deploy`
+7. `abra app deploy <app-name>`
 
 ## Installing a custom theme
 
-`abra app YOURAPPDOMAIN cp ~/path/to/local/theme wordpress:/var/www/html/wp-content/themes/`
+`abra app cp <app-name> ~/path/to/local/theme wordpress:/var/www/html/wp-content/themes/`
 
 ## Email
 
@@ -62,10 +73,10 @@ There is a local or remote SMTP relay configuration available.
 Below are the instructions for the local relay.
 
 1. Deploy [`postfix-relay`][cc-postfix-relay]
-2. `abra app YOURAPPDOMAIN config`, and uncomment the email lines; change
+2. `abra app config <app-name>`, and uncomment the email lines; change
    `MAIL_FROM` to make sure the domain is the same as `postfix-relay`'s
    `$DOMAIN` or in its `$EXTRA_SENDER_DOMAINS`
-3. `abra app YOURAPPDOMAIN deploy`
+3. `abra app deploy <app-name>`
 
 [abra]: https://git.autonomic.zone/autonomic-cooperative/abra
 [cc-traefik]: https://git.autonomic.zone/coop-cloud/traefik

abra.sh

@@ -1,86 +1,77 @@
 export PHP_UPLOADS_CONF_VERSION=v3
-export ENTRYPOINT_CONF_VERSION=v3
+export ENTRYPOINT_CONF_VERSION=v6
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
-export MSMTP_CONF_VERSION=v3
+export MSMTP_CONF_VERSION=v4
 
 wp() {
-  /usr/local/bin/wp $@
+    su -p www-data -s /bin/bash -c "/usr/local/bin/wp $@"
+}
+
+core_install(){
+    ADMIN=admin
+    if [ -n "$AUTHENTIK_DOMAIN" ]
+    then
+        ADMIN=akadmin
+    fi
+    chown www-data:www-data -R /var/www/html/wp-content
+    wp "core install --url=$DOMAIN --title=\"$TITLE\" --admin_user=$ADMIN --admin_email=$ADMIN_EMAIL --locale=$LOCALE --skip-email"
+    wp "language core install $LOCALE"
+    wp "site switch-language $LOCALE"
+    wp "rewrite structure '/%year%/%monthnum%/%day%/%postname%/'"
+    wp "plugin install --activate disable-update-notifications"
+    wp "option update disable_notification_setting --format=json '{\"dpun_setting\":false,\"dwtu_setting\":false,\"dwcun_setting\":true}'"
+    if [ -n "$DEFAULT_USER_ROLE" ]
+    then
+        wp "option set default_role $DEFAULT_USER_ROLE"
+    else
+        wp "option set default_role subscriber"
+    fi
+    wp 'plugin auto-updates enable --all' || exit 0
+}
+
+set_authentik(){
+    AUTHENTIK_SECRET=$(cat /run/secrets/authentik_secret)
+    AUTHENTIK_ID=$(cat /run/secrets/authentik_id)
+    if [ -z $LOGIN_TYPE ]
+    then
+        LOGIN_TYPE='button'
+    fi
+    wp "user create akadmin admin@example.com --role=administrator"
+    wp "plugin install --activate daggerhart-openid-connect-generic"
+    wp "option update --format=json openid_connect_generic_settings '
+    {
+        \"login_type\":\"$LOGIN_TYPE\",
+        \"client_id\":\"$AUTHENTIK_ID\",
+        \"client_secret\":\"$AUTHENTIK_SECRET\",
+        \"scope\":\"email profile openid\",
+        \"endpoint_login\":\"https://$AUTHENTIK_DOMAIN/application/o/authorize/\",
+        \"endpoint_userinfo\":\"https://$AUTHENTIK_DOMAIN/application/o/userinfo/\",
+        \"endpoint_token\":\"https://$AUTHENTIK_DOMAIN/application/o/token/\",
+        \"endpoint_end_session\":\"https://$AUTHENTIK_DOMAIN/application/o/wordpress/end-session/\",
+        \"acr_values\":\"\",
+        \"identity_key\":\"preferred_username\",
+        \"no_sslverify\":\"0\",
+        \"http_request_timeout\":\"30\",
+        \"enforce_privacy\":\"0\",
+        \"alternate_redirect_uri\":\"1\",
+        \"nickname_key\":\"preferred_username\",
+        \"email_format\":\"{email}\",
+        \"displayname_format\":\"\",
+        \"identify_with_username\":\"1\",
+        \"state_time_limit\":\"\",
+        \"token_refresh_enable\":\"1\",
+        \"link_existing_users\":\"1\",
+        \"create_if_does_not_exist\":\"1\",
+        \"redirect_user_back\":\"0\",
+        \"redirect_on_logout\":\"1\",
+        \"enable_logging\":\"0\",
+        \"log_limit\":\"1000\"
+    }'"
+    wp "rewrite flush"
+    wp "cache flush"
+
 }
 
 fix_mysql() {
   echo "ALTER TABLE mysql.column_stats MODIFY histogram longblob; ALTER TABLE mysql.column_stats MODIFY hist_type enum('SINGLE_PREC_HB','DOUBLE_PREC_HB','JSON_HB');" | mysql -u root -p$(cat /run/secrets/db_root_password)
 }
-
-sub_wp() {
-  CONTAINER=$(docker container ls -f "Name=${STACK_NAME}_app" --format '{{ .ID }}')
-  if [ -z "$CONTAINER" ]; then
-    error "Can't find a container for ${STACK_NAME}_app"
-    exit
-  fi
-  debug "Using Container ID ${CONTAINER}"
-
-  # FIXME 3wc: we're fighting the Wordpress image, which recommends a named
-  # volume for /var/www/html -- this used to work fine using --volumes-from
-  # because the actual MySQL password was inserted into the generated
-  # wp-config.php -- but as of Wordpress 5.7.0, wp-config loads data straight
-  # from the environment, which requires Docker secrets to work, which only work
-  # in swarm services (not one-off `docker run` commands). Defining a `cli`
-  # service in compose.yml almost works, but there's no volumes_from: in Compose
-  # V3, and without it then the `cli` service can't access Wordpress core.
-  # See https://git.autonomic.zone/coop-cloud/wordpress/issues/21
-  warning "Slowly looking up MySQL password..."
-  silence
-  abra__service_="app"
-  DB_PASSWORD="$(sub_app_run cat "/run/secrets/db_password")"
-  unsilence
-
-  # shellcheck disable=SC2154,SC2086
-  docker run -it \
-	--volumes-from "$CONTAINER" \
-	--network "container:$CONTAINER" \
-	-u xfs:xfs \
-    -e WORDPRESS_DB_HOST=db \
-    -e WORDPRESS_DB_USER=wordpress \
-    -e WORDPRESS_DB_PASSWORD="${DB_PASSWORD}" \
-    -e WORDPRESS_DB_NAME=wordpress \
-    -e WORDPRESS_CONFIG_EXTRA="${WORDPRESS_CONFIG_EXTRA}" \
-	wordpress:cli wp ${abra__args_[*]}
-}
-
-abra_backup_app() {
-  _abra_backup_dir "app:/var/www/html/wp-content"
-}
-
-abra_backup_db() {
-  _abra_backup_mysql "db" "wordpress"
-}
-
-abra_backup() {
-  abra_backup_app && abra_backup_db
-}
-
-abra_restore_app() {
-  # shellcheck disable=SC2034
-  {
-	abra__src_="-"
-	abra__dst_="app:/var/www/html/"
-  }
-
-  zcat "$@" | sub_app_cp
-
-  success "Restored 'app'"
-}
-
-abra_restore_db() {
-  # 3wc: unlike abra_backup_db, we can assume abra__service_ will be 'db' if we
-  # got this far..
-
-  # shellcheck disable=SC2034
-  abra___no_tty="true"
-
-  DB_ROOT_PASSWORD=$(sub_app_run cat /run/secrets/db_root_password)
-
-  zcat "$@" | sub_app_run mysql -u root -p"$DB_ROOT_PASSWORD" wordpress
-
-  success "Restored 'db'"
-}

compose.authentik.yml

@@ -0,0 +1,14 @@
+version: "3.8"
+services:
+  app:
+    secrets:
+      - authentik_secret
+      - authentik_id
+
+secrets:
+  authentik_secret:
+    external: true
+    name: ${STACK_NAME}_authentik_secret_${SECRET_AUTHENTIK_SECRET_VERSION}
+  authentik_id:
+    external: true
+    name: ${STACK_NAME}_authentik_id_${SECRET_AUTHENTIK_ID_VERSION}

compose.composer.yml

@@ -0,0 +1,14 @@
+---
+version: "3.8"
+
+services:
+  app:
+    volumes:
+      - "composer:/var/www/html/composer"
+    environment:
+      - ENABLE_COMPOSER=1
+      - COMPOSER=composer/composer.json
+      - COMPOSER_VENDOR_DIR=composer/vendor
+
+volumes:
+  composer:

compose.public-db.yml

@@ -0,0 +1,9 @@
+---
+version: "3.8"
+
+services:
+  db:
+    ports:
+      - target: 3306
+        published: 3306
+        mode: host

compose.smtp.yml

@@ -6,11 +6,12 @@ services:
     secrets:
       - smtp_password
     environment:
-      - SMTP_HOST=${SMTP_HOST}
+      - SMTP_HOST
       - SMTP_PORT=${SMTP_PORT:-25}
-      - SMTP_AUTH=${SMTP_AUTH}
+      - SMTP_AUTH
-      - SMTP_TLS=${SMTP_TLS}
+      - SMTP_TLS
-      - MAIL_FROM=${MAIL_FROM}
+      - MAIL_FROM
+      - SMTP_OVERRIDE_FROM
 
 secrets:
   smtp_password:

compose.yml

@@ -3,21 +3,26 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:6.1.1"
+    image: "wordpress:6.4.1"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
       - backend
       - proxy
     environment:
-      - PAGER=more
+      WORDPRESS_CONFIG_EXTRA: |
-      - WORDPRESS_DB_HOST=db
+            define( 'AUTOMATIC_UPDATER_DISABLED', false );
-      - WORDPRESS_DB_USER=wordpress
+            define( 'WP_AUTO_UPDATE_CORE', false );
-      - WORDPRESS_DB_PASSWORD_FILE=/run/secrets/db_password
+            ${WORDPRESS_CONFIG_EXTRA}
-      - WORDPRESS_DB_NAME=wordpress
+      PAGER: more
-      - WORDPRESS_CONFIG_EXTRA=${WORDPRESS_CONFIG_EXTRA}
+      WORDPRESS_DB_HOST: db
-      - WORDPRESS_TABLE_PREFIX
+      WORDPRESS_DB_USER: wordpress
-      - PHP_EXTENSIONS
+      WORDPRESS_DB_PASSWORD_FILE: /run/secrets/db_password
+      WORDPRESS_DB_NAME: wordpress
+      WORDPRESS_TABLE_PREFIX: ${WORDPRESS_TABLE_PREFIX:-wp_}
+      PHP_EXTENSIONS: ${PHP_EXTENSIONS}
+      CORS_ALLOW_ALL:
+      COMPOSER:
     secrets:
       - db_password
     configs:
@@ -50,12 +55,13 @@ services:
         #- "traefik.http.routers.${STACK_NAME}.rule=HostRegexp(`{subdomain:.+}.${DOMAIN}`, `${DOMAIN}`)"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
-        - "coop-cloud.${STACK_NAME}.version=2.2.1+6.1.1"
+        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
         - "backupbot.backup=true"
         - "backupbot.backup.path=/var/www/html"
+        - "coop-cloud.${STACK_NAME}.version=2.6.2+6.4.1"
 
   db:
-    image: "mariadb:10.8"
+    image: "mariadb:11.2"
     volumes:
       - "mariadb:/var/lib/mysql"
     networks:
@@ -71,11 +77,11 @@ services:
     deploy:
       labels:
         backupbot.backup: "true"
-        backupbot.backup.path: "/tmp/dump.sql.gz"
+        backupbot.backup.pre-hook: "sh -c 'mariadb-dump --single-transaction -u root -p\"$$(cat /run/secrets/db_root_password)\" wordpress | gzip > /var/lib/mysql/dump.sql.gz'"
-        backupbot.backup.pre-hook: "sh -c 'mysqldump --single-transaction -u root -p\"$$(cat /run/secrets/db_root_password)\" wordpress | gzip > /tmp/dump.sql.gz'"
+        backupbot.backup.path: "/var/lib/mysql/dump.sql.gz"
-        backupbot.backup.post-hook: "rm -f /tmp/dump.sql.gz"
+        backupbot.backup.post-hook: "rm -f /var/lib/mysql/dump.sql.gz"
         backupbot.restore: "true"
-        backupbot.restore.post-hook: "sh -c 'mysql -u root -p\"$$(cat /run/secrets/db_root_password)\" wordpress < /tmp/dbdump.sql && rm -f /tmp/dbdump.sql'"
+        backupbot.restore.post-hook: "sh -c 'gzip -d /var/lib/mysql/dump.sql.gz && mariadb -u root -p\"$$(cat /run/secrets/db_root_password)\" wordpress < /var/lib/mysql/dump.sql && rm -f /var/lib/mysql/dump.sql'"
 
 networks:
   backend:

entrypoint.sh.tmpl

@@ -7,6 +7,23 @@ docker-php-ext-install {{ env "PHP_EXTENSIONS" }}
 curl -z /usr/local/bin/wp -o /usr/local/bin/wp https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
 chmod +x /usr/local/bin/wp
 
+{{ if eq (env "ENABLE_COMPOSER") "1" }}
+mkdir -p /var/www/.composer
+chown www-data:www-data /var/www/.composer /var/www/html/composer
+
+curl https://getcomposer.org/installer -o /tmp/composer-setup.php
+php -r "if (hash_file('sha384', '/tmp/composer-setup.php') === 'e21205b207c3ff031906575712edab6f13eb0b361f2085f1f1237b7126d785e826a450292b6cfd1d64d92e6563bbde02') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
+php /tmp/composer-setup.php
+rm /tmp/composer-setup.php
+
+mv /var/www/html/composer.phar /usr/local/bin/composer
+{{ end }}
+
+{{ if eq (env "CORS_ALLOW_ALL") "1" }}
+a2enmod headers
+sed -ri -e 's/^([ \t]*)(<\/VirtualHost>)/\1\tHeader set Access-Control-Allow-Origin "*"\n\1\2/g' /etc/apache2/sites-available/*.conf
+{{ end }}
+
 if [ -n "$@" ]; then
 	"$@"
 fi

msmtp.conf.tmpl

@@ -1,9 +1,13 @@
 account default
 host {{ env "SMTP_HOST" }}
 from {{ env "MAIL_FROM" }}
-user {{ env "MAIL_FROM" }}
+user {{ or (env "SMTP_USER") (env "MAIL_FROM") }}
 port {{ env "SMTP_PORT" }}
 
+{{ if eq (env "SMTP_OVERRIDE_FROM") "on" }}
+set_from_header on
+{{ end }}
+
 {{ if eq (env "SMTP_AUTH") "on" }}
 auth {{ env "SMTP_AUTH" }}
 passwordeval "cat /run/secrets/smtp_password"

release/next

@@ -0,0 +1 @@
+The authentik secrets need to be inserted again, as wordpress is not sharing the secret with authentik any more.