Adding wordpress app.

all-apps/docker-compose.yaml

@@ -23,4 +23,6 @@ services:
       - lb
 networks:
   lb:
-
+    ipam:
+      config:
+        - subnet: 172.30.0.0/16

all-apps/wordpress/8.4/Caddyfile

@@ -0,0 +1,3 @@
+{$wordpress_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  reverse_proxy http://wordpress_caddy:80
+}

all-apps/wordpress/8.4/Caddyfile-internal

@@ -0,0 +1,11 @@
+:80 {
+    root * /var/www/html
+
+    encode gzip zstd
+
+    php_fastcgi wordpress:9000 {
+        trusted_proxies 172.30.0.0/16
+    }
+
+    file_server
+}

all-apps/wordpress/8.4/Makefile

@@ -0,0 +1,8 @@
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/wordpress/wordpress_db_password \
+app/wordpress/wordpress_db_root_password
+
+app/wordpress/wordpress_db_password: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$WORDPRESS_DB_PASSWORD" > $@'
+app/wordpress/wordpress_db_root_password: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$WORDPRESS_DB_ROOT_PASSWORD" > $@'

all-apps/wordpress/8.4/custom.ini

@@ -0,0 +1,4 @@
+upload_max_filesize = 256M
+post_max_size = 256M
+memory_limit = 256M
+max_execution_time = 300

all-apps/wordpress/8.4/docker-compose.yaml

@@ -0,0 +1,108 @@
+secrets:
+  wordpress_db_password:
+    file: ./wordpress/wordpress_db_password
+  wordpress_db_root_password:
+    file: ./wordpress/wordpress_db_root_password
+
+services:
+
+  wordpress_caddy:
+    image: docker.io/caddy:2.11.4-alpine
+    volumes:
+      - ./wordpress/Caddyfile-internal:/etc/caddy/Caddyfile:ro
+      - /nassella/wordpress/caddy-config:/config
+      - /nassella/wordpress/caddy-data:/data
+      - /nassella/wordpress/var-www-html:/var/www/html:ro
+    networks:
+      - lb
+      - wordpress_instance
+    restart: unless-stopped
+    depends_on:
+      - wordpress
+  wordpress:
+    image: wordpress:php8.4-fpm
+    restart: unless-stopped
+    environment:
+      WORDPRESS_DB_HOST: wordpress_db
+      WORDPRESS_DB_USER: wordpress
+      WORDPRESS_DB_PASSWORD_FILE: /run/secrets/wordpress_db_password
+      WORDPRESS_DB_NAME: wordpress
+    depends_on:
+      wordpress_db:
+        condition: service_healthy
+    volumes:
+      - /nassella/wordpress/var-www-html:/var/www/html
+      - ./wordpress/custom.ini:/usr/local/etc/php/conf.d/custom.ini:ro
+    networks:
+      - wordpress_db
+      - wordpress_instance
+      - wordpress_outbound
+    secrets:
+      - wordpress_db_password
+
+  wordpress_db:
+    image: mysql:9.7
+    restart: always
+    environment:
+      MYSQL_DATABASE: wordpress
+      MYSQL_USER: wordpress
+      MYSQL_PASSWORD_FILE: /run/secrets/wordpress_db_password
+      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/wordpress_db_root_password
+    volumes:
+      - /nassella/wordpress/var-lib-mysql:/var/lib/mysql
+    networks:
+      - wordpress_db
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "MYSQL_PWD=$$(cat /run/secrets/wordpress_mysql_root_password) mysqladmin ping -h 127.0.0.1 -uroot --silent"
+        ]
+      interval: 1s
+      start_period: 30s
+      start_interval: 10s
+      retries: 120
+    secrets:
+      - wordpress_db_password
+      - wordpress_db_root_password
+
+  # wordpress_init:
+  #   image: wordpress:cli-php8.4
+  #   restart: "no"
+  #   depends_on:
+  #     - wordpress_db
+  #     - wordpress
+  #   environment:
+  #     WORDPRESS_DB_HOST: db
+  #     WORDPRESS_DB_USER: exampleuser
+  #     WORDPRESS_DB_PASSWORD: examplepass
+  #     WORDPRESS_DB_NAME: exampledb
+
+  #     WP_URL: "https://wp.nassella.org"
+  #     WP_TITLE: "Nassella"
+  #     WP_ADMIN_USER: "admin"
+  #     WP_ADMIN_PASSWORD: "admin"
+  #     WP_ADMIN_EMAIL: "admin@example.org"
+
+  #     OIDC_CLIENT_ID: wordpress
+  #     OIDC_CLIENT_SECRET: "secret"
+  #     OIDC_PROVIDER: "https://auth.nassella.org"
+
+  #   volumes:
+  #     - /nassella/wordpress/var-www-html:/var/www/html
+  #     - ./init:/scripts
+
+  #   entrypoint:
+  #     - /bin/bash
+  #     - /scripts/init.sh
+
+networks:
+  lb:
+  wordpress_instance:
+    driver: bridge
+    internal: true
+  wordpress_outbound:
+    driver: bridge
+  wordpress_db:
+    driver: bridge
+    internal: true

all-apps/wordpress/8.4/init.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+set -e
+
+echo "Waiting for db..."
+
+until wp db check --allow-root
+do
+    sleep 5
+done
+
+echo "db ready"
+
+if ! wp core is-installed --allow-root
+then
+    echo "installing wp"
+
+    wp core install \
+       --url="$WP_URL" \
+       --title="$WP_TITLE" \
+       --admin_user="$WP_ADMIN_USER" \
+       --admin_password="$WP_ADMIN_PASSWORD" \
+       --admin_email="$WP_ADMIN_EMAIL" \
+       --skip-email \
+       --allow-root
+fi
+
+echo "installing plugins"
+
+if ! wp plugin is-installed daggerhart-openid-connect-generic
+then
+    wp plugin install daggerhart-openid-connect-generic \
+       --activate \
+       --allow-root
+fi
+
+if ! wp plugin is-active daggerhart-openid-connect-generic
+then
+    wp plugin activate daggerhart-openid-connect-generic
+fi
+
+echo "plugins installed. configuring plugins"
+
+# after installing the plugs we can then use the plugin's CLI
+# to configure the plugin
+wp option update openid_connect_generic_settings 'the settings' # TODO lookup
+# or
+wp option patch update ...

src/db-init.sql

@@ -45,6 +45,7 @@ insert into apps(app_name) values ('nassella');
 insert into apps(app_name) values ('log-viewer');
 insert into apps(app_name) values ('ghost');
 insert into apps(app_name) values ('instance-control');
+insert into apps(app_name) values ('wordpress');
 
 create table user_selected_apps(
        id bigserial primary key,
@@ -117,3 +118,4 @@ insert into migrations(migration_id) values(1);
 insert into migrations(migration_id) values(2);
 insert into migrations(migration_id) values(3);
 insert into migrations(migration_id) values(4);
+insert into migrations(migration_id) values(5);

src/db.scm

@@ -625,7 +625,8 @@ where user_id=$1;"
     (1 . "adding-service-config-digitalocean-volume-size")
     (2 . "adding-deployments-instance-backup")
     (3 . "normalizing-apps")
-    (4 . "fixing-app-normalization")))
+    (4 . "fixing-app-normalization")
+    (5 . "adding-wordpress-app")))
 
 (define (run-pending-migrations conn)
   (let* ((migration-ids (sort (map car *migrations*) <))

src/migrations/5-adding-wordpress-app-up.sql

@@ -0,0 +1 @@
+insert into apps(app_name) values('wordpress');

src/nassella.scm

@@ -1111,6 +1111,7 @@ chmod -R 777 /opt/keys")))
              `((Field (@ (name "nassella") (type "checkbox") (label ("Nassella")) (checked ,(member 'nassella (alist-ref 'selected-apps results)))))))
             (else
              '()))
+         (Field (@ (name "wordpress") (type "checkbox") (label ("wordpress")) (checked ,(member 'wordpress (alist-ref 'selected-apps results)))))
          (Field (@ (name "log-viewer") (type "checkbox") (label ("Log Viewer")) (checked #t) (disabled "disabled"))))
         ;; TODO add config for when automatic upgrades are scheduled for?
         ;; TODO add config for server timezone?
@@ -1129,6 +1130,7 @@ chmod -R 777 /opt/keys")))
                   (nextcloud . ,(or (and (alist-ref 'nextcloud (current-params)) "34") #f))
                   (ghost . ,(or (and (alist-ref 'ghost (current-params)) "6") #f))
                   (nassella . ,(or (and (alist-ref 'nassella (current-params)) "b0.0.1") #f))
+                  (wordpress . ,(or (and (alist-ref 'wordpress (current-params)) "8.4") #f))
                   (instance-control . "b0.0.1")
                   (log-viewer . "20"))))
        (update-root-domain db
@@ -1187,6 +1189,11 @@ chmod -R 777 /opt/keys")))
                  (Field (@ (name "nassella-stripe-api-key") (label ("Stripe API Key")) (type "password")
                            (value ,(alist-ref 'stripe-api-key (alist-ref 'nassella app-config eq? '()) eq? ""))))))
               '())
+        ,@(if (member 'wordpress selected-apps)
+              `((Fieldset
+                 (@ (title "Wordpress"))
+                 (Field (@ (name "wordpress-subdomain") (label ("Subdomain")) (value ,(alist-ref 'subdomain (alist-ref 'wordpress app-config eq? '()) eq? "wordpress"))))))
+              '())
         (Fieldset
          (@ (title "Log Viewer"))
          (Field (@ (name "log-viewer-subdomain") (label ("Subdomain"))
@@ -1262,6 +1269,13 @@ chmod -R 777 /opt/keys")))
                         (authelia-key-seed . ,(or (alist-ref 'authelia-key-seed
                                                               (alist-ref 'nassella config eq? '()))
                                                    (generate-authelia-key-seed)))))
+           (wordpress . ((subdomain . ,(alist-ref 'wordpress-subdomain (current-params)))
+                         (db-password . ,(or (alist-ref 'db-password
+                                                        (alist-ref 'wordpress config eq? '()))
+                                             (generate-postgres-password)))
+                         (db-root-password . ,(or (alist-ref 'db-root-password
+                                                             (alist-ref 'wordpress config eq? '()))
+                                                  (generate-postgres-password)))))
            (log-viewer . ((subdomain . ,(alist-ref 'log-viewer-subdomain (current-params)))
                           (user . ,(alist-ref 'log-viewer-user (current-params)))
                           (password . ,(alist-ref 'log-viewer-password (current-params)))))
@@ -1463,6 +1477,8 @@ chmod -R 777 /opt/keys")))
                    ("NASSELLA_STRIPE_API_KEY" . ,(alist-ref 'stripe-api-key (alist-ref 'nassella config)))
                    ("NASSELLA_AUTHELIA_JWT_SECRET" . ,(alist-ref 'authelia-jwt-secret (alist-ref 'nassella config)))
                    ("NASSELLA_AUTHELIA_KEY_SEED" . ,(alist-ref 'authelia-key-seed (alist-ref 'nassella config)))
+                   ("WORDPRESS_DB_PASSWORD" . ,(alist-ref 'db-password (alist-ref 'wordpress config)))
+                   ("WORDPRESS_DB_ROOT_PASSWORD" . ,(alist-ref 'db-root-password (alist-ref 'wordpress config)))
                    ("SMTP_HOST" . ,(alist-ref 'smtp-host (alist-ref 'all-apps config)))
                    ("SMTP_PORT" . ,(alist-ref 'smtp-port (alist-ref 'all-apps config)))
                    ("SMTP_AUTH_USER" . ,(alist-ref 'smtp-auth-user (alist-ref 'all-apps config)))