feat: anubis support

Reviewed-on: #76

.env.sample

@@ -38,6 +38,7 @@ LETS_ENCRYPT_ENV=production
 
 SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
+SECRET_ADMIN_PASSWORD_VERSION=v1
 
 # Mostly for compatibility with existing database dumps...
 #WORDPRESS_TABLE_PREFIX=wp_
@@ -94,3 +95,6 @@ SECRET_DB_PASSWORD_VERSION=v1
 #COMPOSE_FILE="$COMPOSE_FILE:compose.ftp-2223.yml"
 #COMPOSE_FILE="$COMPOSE_FILE:compose.ftp-2224.yml"
 #COMPOSE_FILE="$COMPOSE_FILE:compose.ftp-2225.yml"
+
+# Anubis
+#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis.yml"

README.md

@@ -103,3 +103,9 @@ Make a `.tar.gz` backup of the site's `wp-content` dir and a `.sql.gz` backup of
 
 Lastly, if there's a domain name change, run a search and replace:
 `abra app wp.example.com wp "search-replace https://old.example.com https://wp.example.com"`
+
+## Protect Wordpress from scrapers with Anubis
+
+Uncomment the Anubis compose file from the `.env` file and re-deploy the
+app.  Don't forget to actually [enable Anubis on the Traefik app
+too](https://recipes.coopcloud.tech/traefik)!

abra.sh

@@ -27,7 +27,7 @@ core_install(){
         ADMIN=akadmin
     fi
     chown www-data:www-data -R /var/www/html/wp-content
-    wp "core install --url=$DOMAIN --title=\"$TITLE\" --admin_user=$ADMIN --admin_email=$ADMIN_EMAIL --locale=$LOCALE --skip-email"
+    wp "core install --url=$DOMAIN --title=\"$TITLE\" --admin_user=$ADMIN --admin_password=\"\$(cat /run/secrets/admin_password)\" --admin_email=$ADMIN_EMAIL --locale=$LOCALE --skip-email"
     wp "language core install $LOCALE"
     wp "site switch-language $LOCALE"
     wp "rewrite structure '/%year%/%monthnum%/%day%/%postname%/'"
@@ -46,7 +46,7 @@ enable_auto_updates(){
   wp "plugin uninstall disable-update-notifications --allow-root"
   wp "option delete disable_notification_setting --allow-root"
   wp "plugin auto-updates enable --all --allow-root"
-  wp "theme auto-updates enable --all --allow-root"
+  wp "theme auto-updates enable --all --allow-root" || true
 }
 
 disable_auto_updates(){

compose.anubis.yml

@@ -0,0 +1,7 @@
+---
+version: "3.8"
+services:
+  app:
+    deploy:
+      labels:
+      - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirectscheme,${STACK_NAME}-redirecthostname,anubis"

compose.yml

@@ -25,6 +25,7 @@ services:
       COMPOSER:
     secrets:
       - db_password
+      - admin_password
     configs:
       - source: php_uploads_conf
         target: /usr/local/etc/php/conf.d/uploads.ini
@@ -62,7 +63,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=3.0.6+7.0.4"
+        - "coop-cloud.${STACK_NAME}.version=4.0.0+7.0.4"
 
   db:
     image: "mariadb:12.3"
@@ -101,6 +102,9 @@ secrets:
   db_password:
     external: true
     name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
+  admin_password:
+    external: true
+    name: ${STACK_NAME}_admin_password_${SECRET_ADMIN_PASSWORD_VERSION}
 
 configs:
   entrypoint_conf:

release/4.0.0+7.0.4

@@ -0,0 +1 @@
+Breaking Change: the secret admin_password must be added.