582cc81ffe
A stack with TLS in front of it was still publishing nginx on 0.0.0.0, so the admin stayed reachable over plain HTTP on a raw port while the proxy served the same site over HTTPS beside it. On this project's own instance that meant wp-login.php answering 200 to the open internet. There is no password to steal — the account is a key — but the session cookie is the account, and a cookie read off the wire is a logged-in administrator. HTTP_BIND defaults to 0.0.0.0, so a stack with nothing in front behaves exactly as before. The records doc now also explains the pinned self-signed certificate route, which is how a BCNR name gets HTTPS without a certificate authority — and why an editor needs it at all: the publishing key is derived in the page, and crypto.subtle does not exist outside a secure context.
99 lines
3.7 KiB
YAML
99 lines
3.7 KiB
YAML
# Sirius Press — a complete self-hosted stack.
|
|
#
|
|
# Three containers: MariaDB, PHP-FPM with the patched WordPress baked in, and
|
|
# nginx in front. Only nginx is published.
|
|
#
|
|
# The volume layout is the part worth reading. WordPress core comes from the
|
|
# repository's `wordpress/` subtree, is baked into the image, and is refilled
|
|
# into the document root on every start — so `docker compose build && up -d`
|
|
# genuinely upgrades it — the usual arrangement, where the whole document root is a
|
|
# volume, freezes core at whatever version first created the volume and turns
|
|
# every security release into a manual migration. What people actually need to
|
|
# keep — uploads, plugins and themes they installed, and wp-config.php — is
|
|
# what gets a volume.
|
|
#
|
|
# cp .env.example .env # then edit it
|
|
# docker compose up -d
|
|
|
|
name: sirius-press
|
|
|
|
services:
|
|
db:
|
|
image: mariadb:11.4
|
|
restart: unless-stopped
|
|
environment:
|
|
MARIADB_DATABASE: ${DB_NAME:-wordpress}
|
|
MARIADB_USER: ${DB_USER:-wordpress}
|
|
MARIADB_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env}
|
|
MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:?set DB_ROOT_PASSWORD in .env}
|
|
MARIADB_AUTO_UPGRADE: "1"
|
|
command:
|
|
# utf8mb4 throughout: a post containing an emoji should not be a
|
|
# database error, and WordPress has assumed this for years.
|
|
- --character-set-server=utf8mb4
|
|
- --collation-server=utf8mb4_unicode_ci
|
|
volumes:
|
|
- db:/var/lib/mysql
|
|
healthcheck:
|
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 12
|
|
|
|
app:
|
|
build:
|
|
context: ..
|
|
dockerfile: docker/Dockerfile
|
|
restart: unless-stopped
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
WORDPRESS_DB_HOST: db
|
|
WORDPRESS_DB_NAME: ${DB_NAME:-wordpress}
|
|
WORDPRESS_DB_USER: ${DB_USER:-wordpress}
|
|
WORDPRESS_DB_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env}
|
|
WORDPRESS_SITE_URL: ${SITE_URL:-}
|
|
WORDPRESS_DEBUG: ${WP_DEBUG:-false}
|
|
SIRIUS_PRESS_KEY: ${SIRIUS_PRESS_KEY:-}
|
|
# nginx on this compose network. The exporter fetches pages here because
|
|
# a container cannot reach the host's own published port.
|
|
SIRIUS_PRESS_LOOPBACK_URL: ${SIRIUS_PRESS_LOOPBACK_URL:-http://web}
|
|
volumes:
|
|
- config:/var/www/config
|
|
# The document root is a volume so nginx can read the same files. It is
|
|
# refilled from the image on every start, so this does not pin core.
|
|
- core:/var/www/html
|
|
- uploads:/var/www/html/wp-content/uploads
|
|
- plugins:/var/www/html/wp-content/plugins
|
|
- themes:/var/www/html/wp-content/themes
|
|
|
|
web:
|
|
image: nginx:1.27-alpine
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- app
|
|
ports:
|
|
# HTTP_BIND exists for the case where something else terminates TLS in
|
|
# front of this stack. Set it to 127.0.0.1 and the port stops being
|
|
# reachable from outside the machine, which matters more here than on a
|
|
# normal site: wp-admin is the whole account, and a session cookie
|
|
# crossing the internet in clear text hands it over. Default is
|
|
# unchanged, so a stack with nothing in front still works.
|
|
- "${HTTP_BIND:-0.0.0.0}:${HTTP_PORT:-80}:80"
|
|
volumes:
|
|
- ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
|
|
# nginx serves static files directly and only proxies PHP, so it needs
|
|
# to see the same tree. Read-only: the web tier has no business writing.
|
|
- core:/var/www/html:ro
|
|
- uploads:/var/www/html/wp-content/uploads:ro
|
|
- plugins:/var/www/html/wp-content/plugins:ro
|
|
- themes:/var/www/html/wp-content/themes:ro
|
|
|
|
volumes:
|
|
db:
|
|
config:
|
|
core:
|
|
uploads:
|
|
plugins:
|
|
themes:
|