17c60b9e11
Deployed to a real VPS for the first time. The stack came up, the patched wizard served, the plugins activated and the 40-check auth suite passed over the public internet — and then every single export failed: cURL error 28: Failed to connect to <public ip> port 8081 after 10001 ms Not a bug in the export. A container cannot reach the host's own published port on most Docker hosts; there is simply no route back in. The exporter renders each page by asking the site for it over HTTP, so the one thing it depends on is the one thing a container cannot do. This would have hit every user of the documented install path on their first publish, and the error says nothing about the cause. SIRIUS_PRESS_LOOPBACK_URL gives the exporter a second address — in the bundled stack, the nginx service on the compose network — while the request still carries the site's real Host header. That matters twice: WordPress renders exactly the page a visitor gets rather than redirecting to a canonical URL the container cannot follow, and the internal hostname never appears in the exported HTML. Verified on the VPS: the page builds, the content is right, no absolute self-links, no `//web/` leaking out. Also documents the question underneath it — what WP_HOME should be when the site's public address is a BCNR name. Not the name: whatever the server is actually reachable at. The exported links are document-relative, so they work under the name regardless.
171 lines
6.5 KiB
Bash
171 lines
6.5 KiB
Bash
#!/bin/sh
|
|
# Prepare the site, then hand over to PHP-FPM.
|
|
#
|
|
# Three jobs, all of which have to survive an image upgrade without destroying
|
|
# anything the site owner did:
|
|
#
|
|
# 1. WordPress core and the fork's own plugins are copied out of the image
|
|
# into the document root on every start, so rebuilding the image is a
|
|
# real upgrade. Plugins and themes installed from the dashboard live in
|
|
# their own volumes and are left alone.
|
|
#
|
|
# 2. wp-config.php is generated once, into a volume, and copied into place
|
|
# each start. Never regenerated — new salts would end every session, and
|
|
# a new SIRIUS_PRESS_KEY would make the stored publishing phrase
|
|
# undecryptable, which looks exactly like a corrupted wallet.
|
|
#
|
|
# 3. Nothing waits on the network except the database, and that with a
|
|
# bounded timeout: a site that will not start is worse than one that
|
|
# starts and says the database is unreachable.
|
|
|
|
set -eu
|
|
|
|
DOCROOT=/var/www/html
|
|
SOURCE=/opt/sirius-press/core
|
|
CONFIG_STORE=/var/www/config/wp-config.php
|
|
CONFIG=$DOCROOT/wp-config.php
|
|
|
|
random_key() {
|
|
# 64 characters of printable entropy. `tr -dc` over /dev/urandom is the one
|
|
# method available in a slim image without adding tools.
|
|
tr -dc 'A-Za-z0-9!@#%^&*()_+=-' < /dev/urandom | head -c 64
|
|
}
|
|
|
|
wait_for_db() {
|
|
# Compose's healthcheck covers the container, but a first run also has to
|
|
# wait out MariaDB's own initialisation.
|
|
i=0
|
|
while [ "$i" -lt 60 ]; do
|
|
if php -r 'exit(@mysqli_connect(getenv("WORDPRESS_DB_HOST"), getenv("WORDPRESS_DB_USER"), getenv("WORDPRESS_DB_PASSWORD")) ? 0 : 1);' 2>/dev/null; then
|
|
return 0
|
|
fi
|
|
i=$((i + 1))
|
|
sleep 1
|
|
done
|
|
echo "sirius-press: the database did not answer within 60s; starting anyway" >&2
|
|
return 1
|
|
}
|
|
|
|
# --------------------------------------------------------------------- core
|
|
|
|
# Copy everything except wp-content, which has volumes of its own, then put
|
|
# back the directories the fork owns. Anything the site owner installed from
|
|
# the dashboard sits in those same volumes and is never touched.
|
|
echo "sirius-press: syncing WordPress $(cat "$SOURCE/.sirius-core-version" 2>/dev/null || echo '?') into the document root"
|
|
|
|
for entry in "$SOURCE"/*; do
|
|
name="$(basename "$entry")"
|
|
if [ "$name" = "wp-content" ]; then
|
|
continue
|
|
fi
|
|
rm -rf "${DOCROOT:?}/${name}"
|
|
cp -R "$entry" "$DOCROOT/"
|
|
done
|
|
cp "$SOURCE/.sirius-core-version" "$DOCROOT/.sirius-core-version" 2>/dev/null || true
|
|
|
|
mkdir -p "$DOCROOT/wp-content/plugins" "$DOCROOT/wp-content/themes" "$DOCROOT/wp-content/mu-plugins" "$DOCROOT/wp-content/uploads"
|
|
|
|
# Seed bundled themes only when the themes volume is empty — replacing them on
|
|
# every start would undo a site owner's edits to a bundled theme.
|
|
if [ -z "$(ls -A "$DOCROOT/wp-content/themes" 2>/dev/null)" ]; then
|
|
cp -R "$SOURCE/wp-content/themes/." "$DOCROOT/wp-content/themes/" 2>/dev/null || true
|
|
fi
|
|
|
|
# The fork's own plugins are the image's to own, and are replaced outright.
|
|
for dir in "$SOURCE"/wp-content/plugins/sirius-press-*/; do
|
|
[ -d "$dir" ] || continue
|
|
name="$(basename "$dir")"
|
|
rm -rf "${DOCROOT:?}/wp-content/plugins/${name}"
|
|
cp -R "$dir" "$DOCROOT/wp-content/plugins/"
|
|
done
|
|
cp "$SOURCE"/wp-content/mu-plugins/*.php "$DOCROOT/wp-content/mu-plugins/" 2>/dev/null || true
|
|
|
|
# Everything else WordPress ships in wp-content (akismet, the index.php
|
|
# guards) only needs to exist once.
|
|
for extra in akismet index.php; do
|
|
if [ ! -e "$DOCROOT/wp-content/plugins/$extra" ] && [ -e "$SOURCE/wp-content/plugins/$extra" ]; then
|
|
cp -R "$SOURCE/wp-content/plugins/$extra" "$DOCROOT/wp-content/plugins/"
|
|
fi
|
|
done
|
|
|
|
chown -R www-data:www-data "$DOCROOT"
|
|
|
|
# ---------------------------------------------------------------- wp-config
|
|
|
|
if [ ! -f "$CONFIG_STORE" ]; then
|
|
echo "sirius-press: generating wp-config.php"
|
|
|
|
: "${WORDPRESS_DB_HOST:=db}"
|
|
: "${WORDPRESS_DB_NAME:=wordpress}"
|
|
: "${WORDPRESS_DB_USER:=wordpress}"
|
|
: "${WORDPRESS_DB_PASSWORD:=wordpress}"
|
|
: "${WORDPRESS_TABLE_PREFIX:=wp_}"
|
|
if [ -z "${SIRIUS_PRESS_KEY:-}" ]; then
|
|
SIRIUS_PRESS_KEY="$(random_key)"
|
|
fi
|
|
|
|
mkdir -p "$(dirname "$CONFIG_STORE")"
|
|
{
|
|
echo "<?php"
|
|
echo "// Generated by the Sirius Press container on first start."
|
|
echo "// Edit freely — this file is kept in a volume and never rewritten."
|
|
echo
|
|
echo "define( 'DB_NAME', '${WORDPRESS_DB_NAME}' );"
|
|
echo "define( 'DB_USER', '${WORDPRESS_DB_USER}' );"
|
|
echo "define( 'DB_PASSWORD', '${WORDPRESS_DB_PASSWORD}' );"
|
|
echo "define( 'DB_HOST', '${WORDPRESS_DB_HOST}' );"
|
|
echo "define( 'DB_CHARSET', 'utf8mb4' );"
|
|
echo "define( 'DB_COLLATE', '' );"
|
|
echo
|
|
for k in AUTH_KEY SECURE_AUTH_KEY LOGGED_IN_KEY NONCE_KEY \
|
|
AUTH_SALT SECURE_AUTH_SALT LOGGED_IN_SALT NONCE_SALT; do
|
|
echo "define( '${k}', '$(random_key)' );"
|
|
done
|
|
echo
|
|
echo "// The key the publishing phrase is encrypted with. Separate from"
|
|
echo "// the auth salts so rotating sessions does not orphan the stored"
|
|
echo "// key. Lose this and the phrase must be entered again."
|
|
echo "define( 'SIRIUS_PRESS_KEY', '${SIRIUS_PRESS_KEY}' );"
|
|
echo
|
|
echo "// nginx terminates TLS in front of this container, so PHP has to"
|
|
echo "// be told. Without it WordPress builds http:// URLs and a"
|
|
echo "// redirect loop follows."
|
|
echo "if ( isset( \$_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === \$_SERVER['HTTP_X_FORWARDED_PROTO'] ) {"
|
|
echo " \$_SERVER['HTTPS'] = 'on';"
|
|
echo "}"
|
|
echo "define( 'SIRIUS_PRESS_TRUST_PROXY', true );"
|
|
echo
|
|
echo "// Where the static exporter fetches this site's own pages."
|
|
echo "// A container cannot reach the host's public address on most Docker"
|
|
echo "// hosts — the request times out instead of arriving at nginx — so the"
|
|
echo "// exporter goes to the web container directly and carries the site's"
|
|
echo "// real Host header, which keeps the rendered page identical."
|
|
echo "define( 'SIRIUS_PRESS_LOOPBACK_URL', '${SIRIUS_PRESS_LOOPBACK_URL:-http://web}' );"
|
|
echo
|
|
if [ -n "${WORDPRESS_SITE_URL:-}" ]; then
|
|
echo "define( 'WP_HOME', '${WORDPRESS_SITE_URL}' );"
|
|
echo "define( 'WP_SITEURL', '${WORDPRESS_SITE_URL}' );"
|
|
fi
|
|
echo "define( 'FS_METHOD', 'direct' );"
|
|
echo "define( 'WP_DEBUG', ${WORDPRESS_DEBUG:-false} );"
|
|
echo
|
|
echo "\$table_prefix = '${WORDPRESS_TABLE_PREFIX}';"
|
|
echo
|
|
echo "if ( ! defined( 'ABSPATH' ) ) {"
|
|
echo " define( 'ABSPATH', __DIR__ . '/' );"
|
|
echo "}"
|
|
echo "require_once ABSPATH . 'wp-settings.php';"
|
|
} > "$CONFIG_STORE"
|
|
chmod 640 "$CONFIG_STORE"
|
|
fi
|
|
|
|
cp "$CONFIG_STORE" "$CONFIG"
|
|
chown www-data:www-data "$CONFIG"
|
|
chmod 640 "$CONFIG"
|
|
|
|
|
|
if [ "${1:-}" = "php-fpm" ]; then
|
|
wait_for_db || true
|
|
fi
|
|
|
|
exec "$@"
|