Restrict production wp-admin/wp-login to an IP allowlist (opt-in)

New WP_ADMIN_ALLOWED_IPS env var (space-separated CIDR ranges, matching
Caddy's remote_ip syntax directly). Defaults to 0.0.0.0/0 ::/0 (today's
open behavior) when unset, resolved at the Compose level rather than in
the Caddyfile so an unset var can never leave `remote_ip` with zero
arguments and fail Caddy's startup. admin-ajax.php stays exempt since
WooCommerce routes logged-out storefront AJAX through it. Production
only — staging is already LAN-only.

Verified live: a scratch Caddy instance on a Docker network, with a
sibling container's actual observed source IP used to prove both the
blocked (403 on wp-admin/wp-login, everything else unaffected) and
allowed (matching CIDR lets it through) cases, plus `docker compose
config` to confirm the unset-var default resolves correctly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg

docker-compose.production.yml

@@ -19,6 +19,12 @@ services:
       - "443:443"
     environment:
       SITE_DOMAIN: ${SITE_DOMAIN}
+      # Default keeps wp-admin open to everyone (today's behavior) when
+      # unset — resolved here, not in the Caddyfile, since Compose would
+      # otherwise pass an *empty* string rather than an unset var, and
+      # Caddy's own {$VAR:default} placeholder only applies to a var
+      # that's truly absent, not an empty one.
+      WP_ADMIN_ALLOWED_IPS: ${WP_ADMIN_ALLOWED_IPS:-0.0.0.0/0 ::/0}
     volumes:
       - ./docker/caddy/Caddyfile.production:/etc/caddy/Caddyfile:ro
       - wp_core:/var/www/html:ro