chore: publish 3.0.3+7.0.2 release

This reverts commit 90d44bd3bc.

.drone.yml

@@ -1,28 +1,48 @@
 ---
 kind: pipeline
-name: deploy to swarm-test.autonomic.zone
+name: test
+
 steps:
-  - name: deployment
-    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
-    settings:
-      host: swarm-test.autonomic.zone
-      stack: wordpress
-      generate_secrets: true
-      purge: true
-      deploy_key:
-        from_secret: drone_ssh_swarm_test
-      networks:
-        - proxy
+  - name: test
+    image: alpine:3.24
     environment:
-      DOMAIN: wordpress.swarm-test.autonomic.zone
-      STACK_NAME: wordpress
-      LETS_ENCRYPT_ENV: production
-      SECRET_DB_PASSWORD_VERSION: v1
-      SECRET_DB_ROOT_PASSWORD_VERSION: v1
-      PHP_UPLOADS_CONF_VERSION: v1
-      ENTRYPOINT_CONF_VERSION: v1
-      HTACCESS_CONF_VERSION: v1
+      SHELLCHECK_OPTS: -s bash
+    commands:
+      - apk add --no-cache bash shellcheck py3-yaml curl
+      - curl -sSLo /usr/local/bin/gomplate https://github.com/hairyhenderson/gomplate/releases/download/v5.0.0/gomplate_linux-amd64
+      - chmod +x /usr/local/bin/gomplate
+      - tests/run.sh
+
+  # deployment step disabled: swarm-test.autonomic.zone is down
+  # - name: deployment
+  #   image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+  #   when:
+  #     event:
+  #       - push
+  #     branch:
+  #       - main
+  #   settings:
+  #     host: swarm-test.autonomic.zone
+  #     stack: wordpress
+  #     generate_secrets: true
+  #     purge: true
+  #     deploy_key:
+  #       from_secret: drone_ssh_swarm_test
+  #     networks:
+  #       - proxy
+  #   environment:
+  #     DOMAIN: wordpress.swarm-test.autonomic.zone
+  #     STACK_NAME: wordpress
+  #     LETS_ENCRYPT_ENV: production
+  #     SECRET_DB_PASSWORD_VERSION: v1
+  #     SECRET_DB_ROOT_PASSWORD_VERSION: v1
+  #     PHP_UPLOADS_CONF_VERSION: v1
+  #     ENTRYPOINT_CONF_VERSION: v1
+  #     HTACCESS_CONF_VERSION: v1
 trigger:
+  event:
+    - push
+    - pull_request
   branch:
     - main
 ---

.gitignore

@@ -1 +1,22 @@
+# direnv
 /.envrc
+
+# Environment files (may contain secrets)
+.env
+
+# Logs
+*.log
+
+# OS metadata
+.DS_Store
+Thumbs.db
+
+# Editor/IDE
+*.swp
+*.swo
+*~
+*.bak
+.idea/
+.vscode/
+.project
+.classpath

README.md

@@ -13,52 +13,18 @@ Coöp Cloud + [Wordpress](https://wordpress.org) = 🥳
 * **Backups**: Yes
 * **Email**: 3
 * **Tests**: 2
-* **SSO**: No
+* **SSO**: 2
 
 <!-- endmetadata -->
 
-
 ## Quick start
 
-
 * `abra app new wordpress`
 * `abra app config <app-name>`
 * `abra app secret generate -a <app-name>`
 * `abra app deploy <app-name>`
 * `abra app cmd <app-name> app core_install`
 
-### Authentik Integration
-
-
-`abra app config <app-name>` 
-Configure the following envs:
-```
-COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
-AUTHENTIK_DOMAIN=authentik.example.com
-AUTHENTIK_SECRET_NAME=authentik_example_com_wordpress_secret_v1  # the same as in authentik
-AUTHENTIK_ID_NAME=authentik_example_com_wordpress_id_v1  # the same as in authentik
-```
-
-`abra app cmd <app-name> app set_authentik`
-
-## Running WP-CLI
-
-`abra app cmd <app-name> app wp -- core check-update --major`
-
-## Network (Multi-site)
-
-1. Set up as above
-2. `abra app config <app-name>`, and uncomment `#MULTISITE=enable`
-3. `abra app deploy <app-name>`
-4. Log into the Wordpress admin dashboard, go to Tools » Network Setup
-5. Don't worry about the suggested file changes
-6. `abra app config <app-name>` again and set `MULTISITE` to either `subdomain` or `subfolder` depending on your setup.
-7. `abra app deploy <app-name>`
-
-## Installing a custom theme
-
-`abra app cp <app-name> ~/path/to/local/theme wordpress:/var/www/html/wp-content/themes/`
-
 ## Email
 
 There is a local or remote SMTP relay configuration available.
@@ -76,4 +42,4 @@ Below are the instructions for the local relay.
 
 [abra]: https://git.autonomic.zone/autonomic-cooperative/abra
 [cc-traefik]: https://git.autonomic.zone/coop-cloud/traefik
-[cc-postfix-relay]: https://git.autonomic.zone/coop-cloud/traefik
+[cc-postfix-relay]: https://git.autonomic.zone/coop-cloud/postfix-relay

abra.sh

@@ -1,12 +1,12 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v8
+export ENTRYPOINT_CONF_VERSION=v10
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
 export HTACCESS_CONF_VERSION=v3
 export USERS_CONF_VERSION=v1
 
 wp() {
-    su -p www-data -s /bin/bash -c "/usr/local/bin/wp $@"
+    su -p www-data -s /bin/bash -c "/usr/local/bin/wp $*"
 }
 
 update() {

compose.selfmanaged.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:latest"
+    image: "wordpress:7.0.2"
     volumes:
       - "wordpress:/var/www/html/"
     environment:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:6.9.4"
+    image: "wordpress:7.0.2"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -62,10 +62,10 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=2.19.2+6.9.4"
+        - "coop-cloud.${STACK_NAME}.version=3.0.3+7.0.2"
 
   db:
-    image: "mariadb:12.2"
+    image: "mariadb:12.3"
     volumes:
       - "mariadb:/var/lib/mysql"
     networks:

entrypoint.sh.tmpl

@@ -52,9 +52,10 @@ if [ ! -f "$UPLOADS_HTACCESS" ]; then
     Require all denied
 </FilesMatch>
 EOF
-    chown www-data:www-data "$UPLOADS_HTACCESS"
 fi
 
+chown -R --from=root:root www-data:www-data /var/www/html/wp-content/
+
 if [ -n "$@" ]; then
 	"$@"
 fi

htaccess.tmpl

@@ -60,8 +60,3 @@ RewriteRule . index.php [L]
 
 # END WordPress Multisite
 {{- end }}
-
-# Block XML-RPC
-<Files xmlrpc.php>
-    Require all denied
-</Files>

release/3.0.0+7.0.0

@@ -0,0 +1,6 @@
+- WordPress upgraded from 6.9.4 to 7.0 (major! test before deploying)
+- MariaDB upgraded from 10.x to 11.4 (major! SSL now enabled by default)
+- ENTRYPOINT_CONF_VERSION bumped to v9
+- Breaking: MariaDB 11.4 enables SSL by default — if clients don't support SSL, add --disable-ssl to db command
+- Breaking: WordPress 7.0 introduces new AI features and admin theme changes
+- Backup database and files before upgrading

release/3.0.1+7.0.2

@@ -0,0 +1 @@
+Bumps Wordpress version to 7.0.2 which fixes CVE-2026-63030

release/3.0.2+7.0.2

@@ -0,0 +1 @@
+Fixes last release which is broken.

release/3.0.3+7.0.2

@@ -0,0 +1 @@
+fix broken conf version in recipe.

renovate.json

@@ -2,5 +2,36 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
+  ],
+  "regexManagers": [
+    {
+      "fileMatch": ["(^|/)compose[^/]*\\.yml$"],
+      "matchStrings": [
+        "image:\\s*\"wordpress:(?<currentValue>[^\"]+)\"",
+        "image:\\s*\"mariadb:(?<currentValue>[^\"]+)\""
+      ],
+      "datasourceTemplate": "docker",
+      "lookupNameTemplate": "{{{packageName}}}"
+    },
+    {
+      "fileMatch": ["(^|/)\\.drone\\.yml$"],
+      "matchStrings": [
+        "gomplate/releases/download/v(?<currentValue>[\\d.]+)/gomplate_linux-amd64"
+      ],
+      "datasourceTemplate": "github-releases",
+      "lookupNameTemplate": "hairyhenderson/gomplate"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["wordpress"],
+      "enabled": true
+    },
+    {
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["mariadb"],
+      "enabled": true
+    }
   ]
 }

tests/fixtures/composer.env

@@ -0,0 +1,2 @@
+DOMAIN=wordpress.example.com
+ENABLE_COMPOSER=1

tests/fixtures/cors.env

@@ -0,0 +1,2 @@
+DOMAIN=wordpress.example.com
+CORS_ALLOW_ALL=1

tests/fixtures/default.env

@@ -0,0 +1 @@
+DOMAIN=wordpress.example.com

tests/fixtures/multisite-enable.env

@@ -0,0 +1,2 @@
+DOMAIN=wordpress.example.com
+MULTISITE=enable

tests/fixtures/multisite-subdomain.env

@@ -0,0 +1,2 @@
+DOMAIN=wordpress.example.com
+MULTISITE=subdomain

tests/fixtures/multisite-subfolder.env

@@ -0,0 +1,2 @@
+DOMAIN=wordpress.example.com
+MULTISITE=subfolder

tests/fixtures/php-extensions.env

@@ -0,0 +1,2 @@
+DOMAIN=wordpress.example.com
+PHP_EXTENSIONS=calendar

tests/fixtures/smtp-full.env

@@ -0,0 +1,8 @@
+DOMAIN=wordpress.example.com
+SMTP_HOST=mail.example.com
+SMTP_PORT=587
+MAIL_FROM=wordpress@example.com
+SMTP_USER=relay@example.com
+SMTP_AUTH=on
+SMTP_TLS=on
+SMTP_OVERRIDE_FROM=on

tests/fixtures/upload-sizes.env

@@ -0,0 +1,3 @@
+DOMAIN=wordpress.example.com
+UPLOAD_MAX_SIZE=512M
+UPLOAD_MAX_TIME=60

tests/run.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+set -euo pipefail
+
+# Root of the project directory
+ROOT="$(dirname "$(realpath "$0")")"
+
+echo "==================================="
+echo "  WordPress Recipe Test Suite"
+echo "==================================="
+echo ""
+
+# Collect all compose files for YAML validation
+COMPOSE_FILES=()
+while IFS= read -r f; do
+    COMPOSE_FILES+=("$f")
+done < <(find "$ROOT/.." -maxdepth 1 -name 'compose*.yml' | sort)
+
+# Collect all tmpl files for shellcheck (only those with bash content)
+SHELL_TMPL_FILES=()
+while IFS= read -r f; do
+    SHELL_TMPL_FILES+=("$f")
+done < <(find "$ROOT/.." -maxdepth 1 -name '*.tmpl' | sort)
+
+# Track total failures across all test suites
+failures=0
+
+# Validate YAML syntax of all compose files
+echo "========================================================================"
+"$ROOT/test_yaml.sh" "${COMPOSE_FILES[@]}" || failures=$((failures + 1))
+echo ""
+
+# Lint shell scripts inside Go templates (after stripping template tags)
+echo "========================================================================"
+"$ROOT/test_shell.sh" "${SHELL_TMPL_FILES[@]}" || failures=$((failures + 1))
+echo ""
+
+# Render templates with fixture env files and verify expected output
+echo "========================================================================"
+"$ROOT/test_templates.sh" || failures=$((failures + 1))
+echo ""
+
+# Validate compose files against the Docker Compose specification
+echo "========================================================================"
+"$ROOT/test_compose_config.sh" || failures=$((failures + 1))
+echo ""
+
+echo "==================================="
+if [ "$failures" -eq 0 ]; then
+    echo "  All tests passed!"
+else
+    echo "  $failures test suite(s) failed"
+fi
+echo "==================================="
+exit "$failures"

tests/test_compose_config.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -euo pipefail
+
+ROOT="$(dirname "$(realpath "$0")")/.."
+pass=0
+fail=0
+
+# Detect available Docker Compose command
+compose_cmd=""
+if command -v docker &>/dev/null && docker compose version &>/dev/null 2>&1; then
+    compose_cmd="docker compose"
+elif command -v docker-compose &>/dev/null; then
+    compose_cmd="docker-compose"
+fi
+
+# Validate a compose file against the Docker Compose specification
+test_compose_config() {
+    local file=$1
+
+    # Skip if Docker Compose is not available on this system
+    if [ -z "$compose_cmd" ]; then
+        echo "  SKIP  $file (no docker compose available)"
+        return
+    fi
+
+    # config -q exits with non-zero if the compose file is invalid
+    if $compose_cmd -f "$file" config -q 2>/dev/null; then
+        echo "  PASS  $file"
+        pass=$((pass + 1))
+    else
+        echo "  FAIL  $file"
+        fail=$((fail + 1))
+    fi
+}
+
+echo "=== Docker Compose Config Validation ==="
+
+# Validate main compose file first, then all override files
+test_compose_config "$ROOT/compose.yml"
+
+while IFS= read -r f; do
+    # Skip the main compose file (already tested above)
+    [ "$f" = "$ROOT/compose.yml" ] && continue
+    [ -f "$f" ] && test_compose_config "$f"
+done < <(find "$ROOT" -maxdepth 1 -name 'compose*.yml' | sort)
+
+echo "---"
+echo "Passed: $pass  Failed: $fail"
+# Exit with failure if any compose file failed validation
+[ "$fail" -eq 0 ]

tests/test_shell.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+set -euo pipefail
+
+pass=0
+fail=0
+
+# Allow overriding shellcheck options via env var (e.g. -s bash)
+EXTRA_SHELLCHECK_OPTS="${SHELLCHECK_OPTS:-}"
+
+# Run shellcheck on a Go template after stripping template tags
+shellcheck_tmpl() {
+    local tmpl=$1
+    # Strip Go template tags ({{ ... }} and {{- ... -}}) into whitespace
+    # so shellcheck can parse the remaining bash.
+    local cleaned
+    cleaned=$(sed 's/{{[-]*[^}]*[-]*}}/true/g' "$tmpl")
+
+    local tmpfile
+    tmpfile=$(mktemp)
+    printf '%s\n' "$cleaned" > "$tmpfile"
+
+    if shellcheck $EXTRA_SHELLCHECK_OPTS "$tmpfile"; then
+        echo "  PASS  $tmpl"
+        pass=$((pass + 1))
+    else
+        echo "  FAIL  $tmpl"
+        fail=$((fail + 1))
+    fi
+    rm -f "$tmpfile"
+}
+
+echo "=== ShellCheck ==="
+# Lint each template file passed as argument
+for f in "$@"; do
+    [ -f "$f" ] && shellcheck_tmpl "$f"
+done
+
+echo "---"
+echo "Passed: $pass  Failed: $fail"
+# Exit with failure if any template failed shellcheck
+[ "$fail" -eq 0 ]

tests/test_templates.sh

@@ -0,0 +1,308 @@
+#!/bin/bash
+set -euo pipefail
+
+ROOT="$(dirname "$(realpath "$0")")/.."
+pass=0
+fail=0
+
+# Allow overriding gomplate binary path via env var
+gomplate="${GOMPLATE_BIN:-gomplate}"
+
+# Ensure gomplate is installed before running template tests
+require_gomplate() {
+    if ! command -v "$gomplate" &>/dev/null; then
+        echo "gomplate not found. Install it from https://github.com/hairyhenderson/gomplate"
+        echo "or set GOMPLATE_BIN env var."
+        exit 1
+    fi
+}
+
+render() {
+    local tmpl=$1 envfile=$2
+    "$gomplate" \
+        --template t="$tmpl" \
+        --context "_=fmt:%s" \
+        --datasource "env=env://?$envfile" \
+        -f "$tmpl" 2>/dev/null
+}
+
+# Render a template by exporting env vars directly
+# This avoids gomplate datasource quirks with .env files
+render_via_env() {
+    local tmpl=$1 envfile=$2
+    # shellcheck disable=2046
+    env $(xargs < "$envfile") "$gomplate" -f "$tmpl" 2>/dev/null
+}
+
+# ---------------------------------------------------------------------------
+# entrypoint.sh.tmpl tests
+# ---------------------------------------------------------------------------
+
+# Default entrypoint: no multisite, uploads guard, chown with --from, wp-cli
+test_entrypoint_default() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "entrypoint.sh.tmpl" "$envfile")
+
+    # Should NOT have multisite config
+    if echo "$output" | grep -q "WP_ALLOW_MULTISITE"; then
+        echo "  FAIL  entrypoint default: unexpected WP_ALLOW_MULTISITE"
+        return 1
+    fi
+    # Should have uploads .htaccess guard
+    if ! echo "$output" | grep -q "Prevent PHP execution in uploads"; then
+        echo "  FAIL  entrypoint default: missing uploads htaccess"
+        return 1
+    fi
+    # Should use --from=root:root on chown
+    if ! echo "$output" | grep -q "chown -R --from=root:root"; then
+        echo "  FAIL  entrypoint default: missing --from=root:root on chown"
+        return 1
+    fi
+    # Should have wp-cli download
+    if ! echo "$output" | grep -q "wp-cli.phar"; then
+        echo "  FAIL  entrypoint default: missing wp-cli download"
+        return 1
+    fi
+    echo "  PASS  entrypoint default"
+}
+
+# Multisite enable: should set WP_ALLOW_MULTISITE
+test_entrypoint_multisite_enable() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "entrypoint.sh.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "WP_ALLOW_MULTISITE"; then
+        echo "  FAIL  entrypoint multisite enable: missing WP_ALLOW_MULTISITE"
+        return 1
+    fi
+    echo "  PASS  entrypoint multisite enable"
+}
+
+# Multisite subdomain: should set MULTISITE, SUBDOMAIN_INSTALL, DOMAIN_CURRENT_SITE
+test_entrypoint_multisite_subdomain() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "entrypoint.sh.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "MULTISITE"; then
+        echo "  FAIL  entrypoint multisite subdomain: missing MULTISITE"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "SUBDOMAIN_INSTALL"; then
+        echo "  FAIL  entrypoint multisite subdomain: missing SUBDOMAIN_INSTALL"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "DOMAIN_CURRENT_SITE"; then
+        echo "  FAIL  entrypoint multisite subdomain: missing DOMAIN_CURRENT_SITE"
+        return 1
+    fi
+    echo "  PASS  entrypoint multisite subdomain"
+}
+
+# Multisite subfolder: should set MULTISITE but not SUBDOMAIN_INSTALL
+test_entrypoint_multisite_subfolder() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "entrypoint.sh.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "MULTISITE"; then
+        echo "  FAIL  entrypoint multisite subfolder: missing MULTISITE"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "SUBDOMAIN_INSTALL"; then
+        echo "  FAIL  entrypoint multisite subfolder: missing SUBDOMAIN_INSTALL"
+        return 1
+    fi
+    echo "  PASS  entrypoint multisite subfolder"
+}
+
+# CORS: should enable Apache headers module and set Access-Control-Allow-Origin
+test_entrypoint_cors() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "entrypoint.sh.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "a2enmod headers"; then
+        echo "  FAIL  entrypoint CORS: missing a2enmod headers"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "Access-Control-Allow-Origin"; then
+        echo "  FAIL  entrypoint CORS: missing Access-Control-Allow-Origin"
+        return 1
+    fi
+    echo "  PASS  entrypoint CORS"
+}
+
+# PHP extensions: should install additional PHP extensions like calendar
+test_entrypoint_php_extensions() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "entrypoint.sh.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "docker-php-ext-install calendar"; then
+        echo "  FAIL  entrypoint PHP extensions: missing docker-php-ext-install calendar"
+        return 1
+    fi
+    echo "  PASS  entrypoint PHP extensions"
+}
+
+# Composer: should download Composer via getcomposer.org
+test_entrypoint_composer() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "entrypoint.sh.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "getcomposer.org"; then
+        echo "  FAIL  entrypoint composer: missing composer download"
+        return 1
+    fi
+    echo "  PASS  entrypoint composer"
+}
+
+# ---------------------------------------------------------------------------
+# htaccess.tmpl tests
+# ---------------------------------------------------------------------------
+
+# Default htaccess: standard WordPress rewrite rule, no multisite section
+test_htaccess_default() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "htaccess.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "RewriteRule . /index.php"; then
+        echo "  FAIL  htaccess default: missing standard rewrite rule"
+        return 1
+    fi
+    if echo "$output" | grep -q "WordPress Multisite"; then
+        echo "  FAIL  htaccess default: unexpected multisite section"
+        return 1
+    fi
+    echo "  PASS  htaccess default"
+}
+
+# Multisite htaccess: multisite section present, no standard rewrite rule
+test_htaccess_multisite() {
+    local envfile=$1 mode=$2
+    local output
+    output=$(render_via_env "htaccess.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "WordPress Multisite"; then
+        echo "  FAIL  htaccess multisite $mode: missing multisite section"
+        return 1
+    fi
+    if echo "$output" | grep -q "^RewriteRule . /index.php"; then
+        echo "  FAIL  htaccess multisite $mode: has non-multisite rewrite rule"
+        return 1
+    fi
+    echo "  PASS  htaccess multisite $mode"
+}
+
+# ---------------------------------------------------------------------------
+# uploads.ini.tmpl tests
+# ---------------------------------------------------------------------------
+
+# Default uploads config: 256M upload limit, 30s execution time
+test_uploads_default() {
+    local output
+    output=$(render_via_env "uploads.ini.tmpl" "tests/fixtures/default.env")
+
+    if ! echo "$output" | grep -q "upload_max_filesize = 256M"; then
+        echo "  FAIL  uploads default: expected 256M upload_max_filesize"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "max_execution_time = 30"; then
+        echo "  FAIL  uploads default: expected 30 max_execution_time"
+        return 1
+    fi
+    echo "  PASS  uploads default"
+}
+
+# Custom uploads config: 512M upload limit, 60s execution time
+test_uploads_custom() {
+    local envfile=$1
+    local output
+    output=$(render_via_env "uploads.ini.tmpl" "$envfile")
+
+    if ! echo "$output" | grep -q "upload_max_filesize = 512M"; then
+        echo "  FAIL  uploads custom: expected 512M"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "max_execution_time = 60"; then
+        echo "  FAIL  uploads custom: expected 60"
+        return 1
+    fi
+    echo "  PASS  uploads custom"
+}
+
+# ---------------------------------------------------------------------------
+# msmtp.conf.tmpl tests
+# ---------------------------------------------------------------------------
+
+# Full SMTP config: host, from, auth, passwordeval, TLS, set_from_header
+test_msmtp_default() {
+    local output
+    output=$(render_via_env "msmtp.conf.tmpl" "tests/fixtures/smtp-full.env")
+
+    if ! echo "$output" | grep -q "host mail.example.com"; then
+        echo "  FAIL  msmtp default: missing host"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "from wordpress@example.com"; then
+        echo "  FAIL  msmtp default: missing from"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "auth on"; then
+        echo "  FAIL  msmtp default: missing auth"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "passwordeval"; then
+        echo "  FAIL  msmtp default: missing passwordeval"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "tls on"; then
+        echo "  FAIL  msmtp default: missing tls"
+        return 1
+    fi
+    if ! echo "$output" | grep -q "set_from_header on"; then
+        echo "  FAIL  msmtp default: missing set_from_header"
+        return 1
+    fi
+    echo "  PASS  msmtp full config"
+}
+
+# ---------------------------------------------------------------------------
+# Run all template tests
+# ---------------------------------------------------------------------------
+echo "=== Template Rendering Tests ==="
+
+cd "$ROOT"
+
+echo "--- entrypoint.sh.tmpl ---"
+require_gomplate
+
+test_entrypoint_default "tests/fixtures/default.env" && pass=$((pass+1)) || fail=$((fail+1))
+test_entrypoint_multisite_enable "tests/fixtures/multisite-enable.env" && pass=$((pass+1)) || fail=$((fail+1))
+test_entrypoint_multisite_subdomain "tests/fixtures/multisite-subdomain.env" && pass=$((pass+1)) || fail=$((fail+1))
+test_entrypoint_multisite_subfolder "tests/fixtures/multisite-subfolder.env" && pass=$((pass+1)) || fail=$((fail+1))
+test_entrypoint_cors "tests/fixtures/cors.env" && pass=$((pass+1)) || fail=$((fail+1))
+test_entrypoint_php_extensions "tests/fixtures/php-extensions.env" && pass=$((pass+1)) || fail=$((fail+1))
+test_entrypoint_composer "tests/fixtures/composer.env" && pass=$((pass+1)) || fail=$((fail+1))
+
+echo "--- htaccess.tmpl ---"
+test_htaccess_default "tests/fixtures/default.env" && pass=$((pass+1)) || fail=$((fail+1))
+test_htaccess_multisite "tests/fixtures/multisite-subfolder.env" "subfolder" && pass=$((pass+1)) || fail=$((fail+1))
+test_htaccess_multisite "tests/fixtures/multisite-subdomain.env" "subdomain" && pass=$((pass+1)) || fail=$((fail+1))
+
+echo "--- uploads.ini.tmpl ---"
+test_uploads_default && pass=$((pass+1)) || fail=$((fail+1))
+test_uploads_custom "tests/fixtures/upload-sizes.env" && pass=$((pass+1)) || fail=$((fail+1))
+
+echo "--- msmtp.conf.tmpl ---"
+test_msmtp_default && pass=$((pass+1)) || fail=$((fail+1))
+
+echo "---"
+echo "Passed: $pass  Failed: $fail"
+# Exit with failure if any template test failed
+[ "$fail" -eq 0 ]

tests/test_yaml.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+set -euo pipefail
+
+pass=0
+fail=0
+
+# Detect available YAML checker: prefer yamllint, fall back to PyYAML
+checker=""
+if command -v yamllint &>/dev/null; then
+    checker=yamllint
+elif python3 -c "import yaml" 2>/dev/null; then
+    checker=python
+fi
+
+# Validate a single YAML file using the available checker
+test_yaml() {
+    local file=$1
+
+    # yamllint provides richer output; PyYAML just checks parseability
+    case "$checker" in
+        yamllint)
+            if yamllint -d "{extends: relaxed, rules: {line-length: disable}}" "$file"; then
+                echo "  PASS  $file"
+                pass=$((pass+1))
+            else
+                echo "  FAIL  $file"
+                fail=$((fail+1))
+            fi
+            ;;
+        python)
+            if python3 -c "
+import yaml, sys
+with open('$file') as f:
+    yaml.safe_load(f)
+" 2>/dev/null; then
+                echo "  PASS  $file"
+                pass=$((pass+1))
+            else
+                echo "  FAIL  $file"
+                fail=$((fail+1))
+            fi
+            ;;
+        # Skip silently if no YAML checker is installed
+        *)
+            echo "  SKIP  $file (no yamllint or PyYAML)"
+            pass=$((pass+1))
+            ;;
+    esac
+}
+
+echo "=== YAML Validation ==="
+# Test each compose file passed as argument
+for f in "$@"; do
+    [ -f "$f" ] && test_yaml "$f"
+done
+
+echo "---"
+echo "Passed: $pass  Failed: $fail"
+# Exit with failure if any file failed validation
+[ "$fail" -eq 0 ]