Merge pull request 'set admin password via secret' (#77) from admin_password into main

Reviewed-on: https://git.coopcloud.tech/coop-cloud/wordpress/pulls/77
Reviewed-by: stevensting <156+stevensting@noreply.git.coopcloud.tech>

.env.sample

@@ -38,6 +38,7 @@ LETS_ENCRYPT_ENV=production
 
 SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
+SECRET_ADMIN_PASSWORD_VERSION=v1
 
 # Mostly for compatibility with existing database dumps...
 #WORDPRESS_TABLE_PREFIX=wp_

abra.sh

@@ -27,7 +27,7 @@ core_install(){
         ADMIN=akadmin
     fi
     chown www-data:www-data -R /var/www/html/wp-content
-    wp "core install --url=$DOMAIN --title=\"$TITLE\" --admin_user=$ADMIN --admin_email=$ADMIN_EMAIL --locale=$LOCALE --skip-email"
+    wp "core install --url=$DOMAIN --title=\"$TITLE\" --admin_user=$ADMIN --admin_password=\"\$(cat /run/secrets/admin_password)\" --admin_email=$ADMIN_EMAIL --locale=$LOCALE --skip-email"
     wp "language core install $LOCALE"
     wp "site switch-language $LOCALE"
     wp "rewrite structure '/%year%/%monthnum%/%day%/%postname%/'"
@@ -46,7 +46,7 @@ enable_auto_updates(){
   wp "plugin uninstall disable-update-notifications --allow-root"
   wp "option delete disable_notification_setting --allow-root"
   wp "plugin auto-updates enable --all --allow-root"
-  wp "theme auto-updates enable --all --allow-root"
+  wp "theme auto-updates enable --all --allow-root" || true
 }
 
 disable_auto_updates(){

compose.selfmanaged.yml

@@ -3,7 +3,6 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:7.0.3"
     volumes:
       - "wordpress:/var/www/html/"
     environment:
@@ -13,9 +12,9 @@ services:
         define( 'FS_METHOD', 'direct' );
         ${WORDPRESS_CONFIG_EXTRA}
 
-  ftp:
+  #ftp:
-    volumes:
+  #  volumes:
-      - "wordpress:/home/ftp_user/"
+  #    - "wordpress:/home/ftp_user/"
 
 volumes:
   wordpress:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:7.0.3"
+    image: "wordpress:7.0.4"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -25,6 +25,7 @@ services:
       COMPOSER:
     secrets:
       - db_password
+      - admin_password
     configs:
       - source: php_uploads_conf
         target: /usr/local/etc/php/conf.d/uploads.ini
@@ -62,7 +63,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=3.0.4+7.0.3"
+        - "coop-cloud.${STACK_NAME}.version=3.0.6+7.0.4"
 
   db:
     image: "mariadb:12.3"
@@ -101,6 +102,9 @@ secrets:
   db_password:
     external: true
     name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
+  admin_password:
+    external: true
+    name: ${STACK_NAME}_admin_password_${SECRET_ADMIN_PASSWORD_VERSION}
 
 configs:
   entrypoint_conf:

release/3.0.5+7.0.4

@@ -0,0 +1 @@
+Includes security fix