By default, WordPress generates a random admin password during core_install and prints it to the command output. To set a known password managed as a Docker secret:

Uncomment SECRET_ADMIN_PASSWORD_VERSION=v1 in your app config
abra app secret generate -a <app-name> (creates a random password)
abra app deploy <app-name>
abra app cmd <app-name> app core_install

The password is stored in <app-name>_admin_password_v1 — you can view it with abra app secret show <app-name> admin_password.

Auto-install on first deploy

To skip the manual abra app cmd ... core_install step, enable auto-install:

Set AUTO_INSTALL=1 in your app config
Uncomment TITLE and ADMIN_EMAIL (also LOCALE if needed)
(Optional) Uncomment SECRET_ADMIN_PASSWORD_VERSION=v1 and run abra app secret generate
abra app deploy <app-name>

On first deploy, the container will wait for the database, then automatically run wp core install and configure the site. It only runs once — subsequent deploys detect WordPress is already installed and skip.

Plugin and theme auto-updates

By default, plugin and theme auto-updates are enabled during install and deploy. To disable this:

Set AUTO_UPDATES=0 in your app config
abra app deploy <app-name>

This affects abra app cmd <app-name> app core_install, abra app cmd <app-name> app update, and the AUTO_INSTALL background process.

Disable the web installer

When migrating a site (importing a DB dump from an existing install), the web-based WordPress installer at wp-admin/install.php is a security risk — someone could accidentally run it and overwrite your data. To block it:

Set DISABLE_WEB_INSTALLER=1 in your app config
abra app deploy <app-name>

Apache inside the container will deny all requests to wp-admin/install.php. The CLI-based abra app cmd <app-name> app core_install still works unaffected.

Email

There is a local or remote SMTP relay configuration available.

local: COMPOSE_FILE=compose.yml:compose.mailrelay.yml
remote: COMPOSE_FILE=compose.yml:compose.mailrelay.yml:compose.smtp.yml

Below are the instructions for the local relay.

Deploy postfix-relay
abra app config <app-name>, and uncomment the email lines; change MAIL_FROM to make sure the domain is the same as postfix-relay's $DOMAIN or in its $EXTRA_SENDER_DOMAINS
abra app deploy <app-name>

WP-CLI

You can either run using abra app cmd:

abra app cmd <app-name> app wp -- core check-update --major

Or by entering the app shell:

abra app run <app-name> app bash
su -s /bin/bash www-data -c "wp core check-update --major"

Network (Multi-site)

Set up as above
abra app config <app-name>, and uncomment #MULTISITE=enable
abra app deploy <app-name>
Log into the WordPress admin dashboard, go to Tools → Network Setup
Don't worry about the suggested file changes
abra app config <app-name> again and set MULTISITE to either subdomain or subfolder depending on your setup.
abra app deploy <app-name>

Installing a custom theme

abra app cp <app-name> ~/path/to/local/theme wordpress:/var/www/html/wp-content/themes/

Authentik Integration

Configure the following envs via abra app config <app-name>:

COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
AUTHENTIK_DOMAIN=authentik.example.com
AUTHENTIK_SECRET_NAME=authentik_example_com_wordpress_secret_v1  # the same as in authentik
AUTHENTIK_ID_NAME=authentik_example_com_wordpress_id_v1  # the same as in authentik

abra app cmd <app-name> app set_authentik

Tests

Run the full test suite for this repository:

bash tests/run.sh

Prerequisites

The test suite uses several tools. Install them with your equivalent of:

brew install shellcheck gomplate

Some tests skip gracefully if their dependencies are missing.

Migrate from a non-Co-op Cloud WordPress install

Make a .tar.gz backup of the site's wp-content dir and a .sql.gz backup of the database.

abra app wp.example.com restore app wp-content.tar.gz
abra app wp.example.com restore db wordpress.sql.gz

Lastly, if there's a domain name change, run a search and replace: abra app wp.example.com wp "search-replace https://old.example.com https://wp.example.com"