Merge pull request 'set admin password via secret' (#77) from admin_password into main

Reviewed-on: #77
Reviewed-by: stevensting <156+stevensting@noreply.git.coopcloud.tech>

.env.sample

@@ -38,6 +38,7 @@ LETS_ENCRYPT_ENV=production
 
 SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
+SECRET_ADMIN_PASSWORD_VERSION=v1
 
 # Mostly for compatibility with existing database dumps...
 #WORDPRESS_TABLE_PREFIX=wp_

README.md

@@ -40,6 +40,66 @@ Below are the instructions for the local relay.
    `$DOMAIN` or in its `$EXTRA_SENDER_DOMAINS`
 3. `abra app deploy <app-name>`
 
-[abra]: https://git.autonomic.zone/autonomic-cooperative/abra
-[cc-traefik]: https://git.autonomic.zone/coop-cloud/traefik
-[cc-postfix-relay]: https://git.autonomic.zone/coop-cloud/postfix-relay
+## WP-CLI
+
+You can either run using `abra app cmd`:
+```bash
+abra app cmd <app-name> app wp -- core check-update --major
+```
+
+Or by entering the app shell:
+1. `abra app run <app-name> app bash`
+2. `su -s /bin/bash www-data -c "wp core check-update --major"`
+
+## Network (Multi-site)
+
+1. Set up as above
+2. `abra app config <app-name>`, and uncomment `#MULTISITE=enable`
+3. `abra app deploy <app-name>`
+4. Log into the WordPress admin dashboard, go to **Tools → Network Setup**
+5. Don't worry about the suggested file changes
+6. `abra app config <app-name>` again and set `MULTISITE` to either `subdomain` or `subfolder` depending on your setup.
+7. `abra app deploy <app-name>`
+
+## Installing a custom theme
+
+`abra app cp <app-name> ~/path/to/local/theme wordpress:/var/www/html/wp-content/themes/`
+
+## Authentik Integration
+
+Configure the following envs via `abra app config <app-name>`:
+```bash
+COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
+AUTHENTIK_DOMAIN=authentik.example.com
+AUTHENTIK_SECRET_NAME=authentik_example_com_wordpress_secret_v1  # the same as in authentik
+AUTHENTIK_ID_NAME=authentik_example_com_wordpress_id_v1  # the same as in authentik
+```
+
+`abra app cmd <app-name> app set_authentik`
+
+## Tests
+
+Run the full test suite for this repository:
+
+```sh
+bash tests/run.sh
+```
+
+### Prerequisites
+
+The test suite uses several tools. Install them with your equivalent of:
+
+```sh
+brew install shellcheck gomplate
+```
+Some tests skip gracefully if their dependencies are missing.
+
+## Migrate from a non-Co-op Cloud WordPress install
+
+Make a `.tar.gz` backup of the site's `wp-content` dir and a `.sql.gz` backup of the database.
+
+1. `abra app wp.example.com restore app wp-content.tar.gz`
+2. `abra app wp.example.com restore db wordpress.sql.gz`
+
+Lastly, if there's a domain name change, run a search and replace:
+`abra app wp.example.com wp "search-replace https://old.example.com https://wp.example.com"`

abra.sh

@@ -1,5 +1,5 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v9
+export ENTRYPOINT_CONF_VERSION=v10
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
 export HTACCESS_CONF_VERSION=v3
@@ -27,7 +27,7 @@ core_install(){
         ADMIN=akadmin
     fi
     chown www-data:www-data -R /var/www/html/wp-content
-    wp "core install --url=$DOMAIN --title=\"$TITLE\" --admin_user=$ADMIN --admin_email=$ADMIN_EMAIL --locale=$LOCALE --skip-email"
+    wp "core install --url=$DOMAIN --title=\"$TITLE\" --admin_user=$ADMIN --admin_password=\"\$(cat /run/secrets/admin_password)\" --admin_email=$ADMIN_EMAIL --locale=$LOCALE --skip-email"
     wp "language core install $LOCALE"
     wp "site switch-language $LOCALE"
     wp "rewrite structure '/%year%/%monthnum%/%day%/%postname%/'"
@@ -46,7 +46,7 @@ enable_auto_updates(){
   wp "plugin uninstall disable-update-notifications --allow-root"
   wp "option delete disable_notification_setting --allow-root"
   wp "plugin auto-updates enable --all --allow-root"
-  wp "theme auto-updates enable --all --allow-root"
+  wp "theme auto-updates enable --all --allow-root" || true
 }
 
 disable_auto_updates(){

compose.selfmanaged.yml

@@ -3,7 +3,6 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:7.0.2"
     volumes:
       - "wordpress:/var/www/html/"
     environment:
@@ -13,9 +12,9 @@ services:
         define( 'FS_METHOD', 'direct' );
         ${WORDPRESS_CONFIG_EXTRA}
 
-  ftp:
-    volumes:
-      - "wordpress:/home/ftp_user/"
+  #ftp:
+  #  volumes:
+  #    - "wordpress:/home/ftp_user/"
 
 volumes:
   wordpress:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:7.0.2"
+    image: "wordpress:7.0.4"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -25,6 +25,7 @@ services:
       COMPOSER:
     secrets:
       - db_password
+      - admin_password
     configs:
       - source: php_uploads_conf
         target: /usr/local/etc/php/conf.d/uploads.ini
@@ -62,7 +63,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=3.0.2+7.0.2"
+        - "coop-cloud.${STACK_NAME}.version=3.0.6+7.0.4"
 
   db:
     image: "mariadb:12.3"
@@ -101,6 +102,9 @@ secrets:
   db_password:
     external: true
     name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
+  admin_password:
+    external: true
+    name: ${STACK_NAME}_admin_password_${SECRET_ADMIN_PASSWORD_VERSION}
 
 configs:
   entrypoint_conf:

release/3.0.3+7.0.2

@@ -0,0 +1 @@
+fix broken conf version in recipe.

release/3.0.5+7.0.4

@@ -0,0 +1 @@
+Includes security fix