From bb63db7d2d13b66e618f35a79b24b449196415e1 Mon Sep 17 00:00:00 2001
From: kawaiipunk <kawaiipunk@posteo.net>
Date: Wed, 3 Jun 2026 22:12:04 +0100
Subject: [PATCH] Add AUTO_UPDATES env var to toggle plugin/theme auto-updates

---
 .env.sample        |  4 ++++
 abra.sh            | 14 ++++++++++----
 compose.yml        |  1 +
 entrypoint.sh.tmpl |  7 +++++--
 4 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/.env.sample b/.env.sample
index f5ce519..02f2f69 100644
--- a/.env.sample
+++ b/.env.sample
@@ -19,6 +19,10 @@ LETS_ENCRYPT_ENV=production
 # Automatically install WordPress on first deploy (requires TITLE and ADMIN_EMAIL)
 #AUTO_INSTALL=1
 
+# Enable auto-updates for plugins and themes on install/deploy (default: on)
+# Set to 0 to disable automatic plugin/theme updates
+#AUTO_UPDATES=1
+
 # Optional settings, otherwise can be set in the installer
 # (Required for `app core_install`
 #TITLE="My Example Blog"
diff --git a/abra.sh b/abra.sh
index e2d66c7..3bcd129 100644
--- a/abra.sh
+++ b/abra.sh
@@ -12,9 +12,13 @@ wp() {
 update() {
     wp "core update-db"
     wp "plugin update --all"
-    wp "plugin auto-updates enable --all"
+    if [ "$AUTO_UPDATES" != "0" ]; then
+        wp "plugin auto-updates enable --all"
+    fi
     wp "theme update --all"
-    wp "theme auto-updates enable --all"
+    if [ "$AUTO_UPDATES" != "0" ]; then
+        wp "theme auto-updates enable --all"
+    fi
     wp "language core update"
     wp "language plugin update --all"
     wp "language theme update --all"
@@ -42,8 +46,10 @@ core_install(){
     else
         wp "option set default_role subscriber"
     fi
-    wp "theme auto-updates enable --all"
-    wp 'plugin auto-updates enable --all' || true
+    if [ "$AUTO_UPDATES" != "0" ]; then
+        wp "theme auto-updates enable --all"
+        wp 'plugin auto-updates enable --all' || true
+    fi
 }
 
 enable_auto_updates(){
diff --git a/compose.yml b/compose.yml
index 7b05702..9ebab52 100644
--- a/compose.yml
+++ b/compose.yml
@@ -24,6 +24,7 @@ services:
       CORS_ALLOW_ALL:
       DISABLE_WEB_INSTALLER:
       AUTO_INSTALL:
+      AUTO_UPDATES:
       COMPOSER:
       SECRET_ADMIN_PASSWORD_VERSION:
     secrets:
diff --git a/entrypoint.sh.tmpl b/entrypoint.sh.tmpl
index 01e83f1..a496d85 100644
--- a/entrypoint.sh.tmpl
+++ b/entrypoint.sh.tmpl
@@ -71,6 +71,7 @@ chown -R --from=root:root www-data:www-data /var/www/html/wp-content/
   ADMIN_EMAIL="{{ getenv "ADMIN_EMAIL" }}"
   LOCALE="{{ getenv "LOCALE" }}"
   DEFAULT_USER_ROLE="{{ getenv "DEFAULT_USER_ROLE" }}"
+  AUTO_UPDATES="{{ getenv "AUTO_UPDATES" }}"
 
   # Wait for wp-config.php (created by upstream entrypoint)
   for _ in $(seq 1 30); do
@@ -114,8 +115,10 @@ chown -R --from=root:root www-data:www-data /var/www/html/wp-content/
   else
     su -p www-data -s /bin/bash -c "/usr/local/bin/wp option set default_role subscriber"
   fi
-  su -p www-data -s /bin/bash -c "/usr/local/bin/wp theme auto-updates enable --all"
-  su -p www-data -s /bin/bash -c "/usr/local/bin/wp plugin auto-updates enable --all" || true
+  if [ "$AUTO_UPDATES" != "0" ]; then
+    su -p www-data -s /bin/bash -c "/usr/local/bin/wp theme auto-updates enable --all"
+    su -p www-data -s /bin/bash -c "/usr/local/bin/wp plugin auto-updates enable --all" || true
+  fi
 ) &
 {{ end }}