582cc81ffe
A stack with TLS in front of it was still publishing nginx on 0.0.0.0, so the admin stayed reachable over plain HTTP on a raw port while the proxy served the same site over HTTPS beside it. On this project's own instance that meant wp-login.php answering 200 to the open internet. There is no password to steal — the account is a key — but the session cookie is the account, and a cookie read off the wire is a logged-in administrator. HTTP_BIND defaults to 0.0.0.0, so a stack with nothing in front behaves exactly as before. The records doc now also explains the pinned self-signed certificate route, which is how a BCNR name gets HTTPS without a certificate authority — and why an editor needs it at all: the publishing key is derived in the page, and crypto.subtle does not exist outside a secure context.
43 lines
2 KiB
Text
43 lines
2 KiB
Text
# Sirius Press — copy to .env and edit before the first `docker compose up`.
|
|
#
|
|
# install.sh writes this file for you with generated passwords. Doing it by
|
|
# hand is fine too; just do not leave the passwords below as they are.
|
|
|
|
# --- database ---------------------------------------------------------------
|
|
# These are read once, when MariaDB initialises its data directory. Changing
|
|
# them later does not change the database — it just stops the app connecting.
|
|
DB_NAME=wordpress
|
|
DB_USER=wordpress
|
|
DB_PASSWORD=change-me
|
|
DB_ROOT_PASSWORD=change-me-too
|
|
|
|
# --- the site ---------------------------------------------------------------
|
|
# The URL visitors reach this instance on. Set it once the name's `p` or `ip`
|
|
# record points here; leaving it blank lets WordPress guess from the request,
|
|
# which is fine for a first run on an IP address.
|
|
SITE_URL=
|
|
|
|
# Port nginx publishes on the host. Put 8080 here if something else already
|
|
# owns 80 and you are running a reverse proxy in front.
|
|
HTTP_PORT=80
|
|
|
|
# Which address that port is published on. Leave it alone for a stack that
|
|
# faces the internet directly. Set it to 127.0.0.1 when a reverse proxy on
|
|
# this machine terminates TLS — the proxy can still reach it, nobody else
|
|
# can, and the admin stops being available over plain HTTP to the world.
|
|
#HTTP_BIND=127.0.0.1
|
|
|
|
WP_DEBUG=false
|
|
|
|
# --- the publishing key ------------------------------------------------------
|
|
# What the site's recovery phrase is encrypted with at rest. Generated on first
|
|
# start if left blank, and then kept in the config volume.
|
|
#
|
|
# Worth setting explicitly and keeping a copy somewhere safe: if this value is
|
|
# lost, the stored phrase cannot be decrypted and has to be entered again.
|
|
# It is not the phrase itself and is useless without the database.
|
|
SIRIUS_PRESS_KEY=
|
|
|
|
# WordPress itself is vendored in the repository (wordpress/) and baked into
|
|
# the image, so there is no version or checksum to configure here. See
|
|
# docs/upstream-merges.md for how a new upstream release gets in.
|