chore: publish 2.19.4+6.9.4 release

.drone.yml

@@ -1,30 +1,30 @@
-# ---
-# kind: pipeline
-# name: deploy to swarm-test.autonomic.zone
-# steps:
-#   - name: deployment
-#     image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
-#     settings:
-#       host: swarm-test.autonomic.zone
-#       stack: wordpress
-#       generate_secrets: true
-#       purge: true
-#       deploy_key:
-#         from_secret: drone_ssh_swarm_test
-#       networks:
-#         - proxy
-#     environment:
-#       DOMAIN: wordpress.swarm-test.autonomic.zone
-#       STACK_NAME: wordpress
-#       LETS_ENCRYPT_ENV: production
-#       SECRET_DB_PASSWORD_VERSION: v1
-#       SECRET_DB_ROOT_PASSWORD_VERSION: v1
-#       PHP_UPLOADS_CONF_VERSION: v1
-#       ENTRYPOINT_CONF_VERSION: v1
-#       HTACCESS_CONF_VERSION: v1
-# trigger:
-#   branch:
-#     - main
+---
+kind: pipeline
+name: deploy to swarm-test.autonomic.zone
+steps:
+  - name: deployment
+    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+    settings:
+      host: swarm-test.autonomic.zone
+      stack: wordpress
+      generate_secrets: true
+      purge: true
+      deploy_key:
+        from_secret: drone_ssh_swarm_test
+      networks:
+        - proxy
+    environment:
+      DOMAIN: wordpress.swarm-test.autonomic.zone
+      STACK_NAME: wordpress
+      LETS_ENCRYPT_ENV: production
+      SECRET_DB_PASSWORD_VERSION: v1
+      SECRET_DB_ROOT_PASSWORD_VERSION: v1
+      PHP_UPLOADS_CONF_VERSION: v1
+      ENTRYPOINT_CONF_VERSION: v1
+      HTACCESS_CONF_VERSION: v1
+trigger:
+  branch:
+    - main
 ---
 kind: pipeline
 name: generate recipe catalogue

.env.sample

@@ -72,19 +72,13 @@ SECRET_DB_PASSWORD_VERSION=v1
 #SECRET_AUTHENTIK_ID_VERSION=v1
 #LOGIN_TYPE='auto'
 
-# Keycloak SSO
-#COMPOSE_FILE="$COMPOSE_FILE:compose.keycloak.yml"
-#KEYCLOAK_DOMAIN=keycloak.example.com
-#SECRET_KEYCLOAK_CLIENT_ID_VERSION=v1
-#SECRET_KEYCLOAK_CLIENT_SECRET_VERSION=v1
-
 # Matrix .well-known redirect
 #COMPOSE_FILE="$COMPOSE_FILE:compose.matrix.yml"
 #MATRIX_DOMAIN=matrix.example.com
 
 # Allow remote connections to db
 # 🚩🚩 dangerous, use only for development sites!
-#COMPOSE_FILE="$COMPOSE_FILE:compose.public-db.yml"
+#COMPOSE_FILE="$COMPOSE_FILE:compose.public-db.yml
 
 # Wide-open CORS
 # 🚩🚩 dangerous, use only for development sites!

.gitignore

@@ -1,22 +1 @@
-# direnv
 /.envrc
-
-# Environment files (may contain secrets)
-.env
-
-# Logs
-*.log
-
-# OS metadata
-.DS_Store
-Thumbs.db
-
-# Editor/IDE
-*.swp
-*.swo
-*~
-*.bak
-.idea/
-.vscode/
-.project
-.classpath

abra.sh

@@ -1,8 +1,8 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v9
+export ENTRYPOINT_CONF_VERSION=v8
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
-export HTACCESS_CONF_VERSION=v3
+export HTACCESS_CONF_VERSION=v4
 export USERS_CONF_VERSION=v1
 
 wp() {

compose.keycloak.yml

@@ -1,14 +0,0 @@
-version: "3.8"
-services:
-  app:
-    secrets:
-      - keycloak_client_id
-      - keycloak_client_secret
-
-secrets:
-  keycloak_client_id:
-    external: true
-    name: ${STACK_NAME}_keycloak_client_id_${SECRET_KEYCLOAK_CLIENT_ID_VERSION}
-  keycloak_client_secret:
-    external: true
-    name: ${STACK_NAME}_keycloak_client_secret_${SECRET_KEYCLOAK_CLIENT_SECRET_VERSION}

compose.selfmanaged.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:7.0.0"
+    image: "wordpress:latest"
     volumes:
       - "wordpress:/var/www/html/"
     environment:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:7.0.0"
+    image: "wordpress:6.9.4"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -62,10 +62,10 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=3.0.0+7.0.0"
+        - "coop-cloud.${STACK_NAME}.version=2.19.4+6.9.4"
 
   db:
-    image: "mariadb:12.3"
+    image: "mariadb:12.2"
     volumes:
       - "mariadb:/var/lib/mysql"
     networks:

entrypoint.sh.tmpl

@@ -52,10 +52,9 @@ if [ ! -f "$UPLOADS_HTACCESS" ]; then
     Require all denied
 </FilesMatch>
 EOF
+    chown www-data:www-data "$UPLOADS_HTACCESS"
 fi
 
-chown -R --from=root:root www-data:www-data /var/www/html/wp-content/
-
 if [ -n "$@" ]; then
 	"$@"
 fi

htaccess.tmpl

@@ -3,6 +3,19 @@
     Require all denied
 </FilesMatch>
 
+# Block XML-RPC
+<Files xmlrpc.php>
+    Require all denied
+</Files>
+
+# Block wp2shell CVE-2026-63030
+<IfModule mod_rewrite.c>
+RewriteEngine On
+RewriteCond %{QUERY_STRING} rest_route=.*/batch/v1 [NC]
+RewriteRule .* - [F,L]
+RewriteRule ^wp-json/batch/v1 - [F,L]
+</IfModule>
+
 {{ if eq (env "MULTISITE") "" -}}
 # BEGIN WordPress
 
@@ -59,4 +72,4 @@ RewriteRule ^(.*\.php)$ $1 [L]
 RewriteRule . index.php [L]
 
 # END WordPress Multisite
-{{- end }}
+{{- end }}

release/2.19.3+6.9.4

@@ -0,0 +1 @@
+patch to block XML-RPC via htaccess

release/2.19.4+6.9.4

@@ -0,0 +1 @@
+temporarily block rest api against wp2shell CVE

release/3.0.0+7.0.0

@@ -1,6 +0,0 @@
-- WordPress upgraded from 6.9.4 to 7.0 (major! test before deploying)
-- MariaDB upgraded from 10.x to 11.4 (major! SSL now enabled by default)
-- ENTRYPOINT_CONF_VERSION bumped to v9
-- Breaking: MariaDB 11.4 enables SSL by default — if clients don't support SSL, add --disable-ssl to db command
-- Breaking: WordPress 7.0 introduces new AI features and admin theme changes
-- Backup database and files before upgrading