Week 1 infrastructure: Docker environments, deploy pipeline, bookstore-core scaffold

Docker Compose environments for dev/staging/production (MariaDB, Redis, Caddy, Action Scheduler cron sidecar), an idempotent deploy script, git-hook-based deploy pipeline, backup/restore scripts, and the bookstore-core plugin stub with WooCommerce HPOS compatibility declared. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-27 09:50:18 -04:00
commit c9d637c907
23 changed files with 757 additions and 0 deletions
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Off-host database + uploads backup (design doc §01, launch gate: "A full
+# backup has been restored successfully into staging" — see restore.sh).
+set -euo pipefail
+
+ENVIRONMENT="${1:?Usage: backup.sh <staging|production>}"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+ENV_FILE=".env.${ENVIRONMENT}"
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
+BACKUP_DIR="${BACKUP_DIR:-./backups}/${ENVIRONMENT}"
+mkdir -p "$BACKUP_DIR"
+
+COMPOSE="docker compose -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+
+echo "==> dumping database"
+$COMPOSE exec -T db sh -c "exec mysqldump -u\"\$MARIADB_USER\" -p\"\$MARIADB_PASSWORD\" \"\$MARIADB_DATABASE\"" \
+  | gzip > "$BACKUP_DIR/db-${TIMESTAMP}.sql.gz"
+
+echo "==> archiving uploads"
+$COMPOSE run --rm -T wordpress tar -czf - -C /var/www/html/wp-content uploads \
+  > "$BACKUP_DIR/uploads-${TIMESTAMP}.tar.gz"
+
+if [[ -n "${BACKUP_REMOTE:-}" ]]; then
+  echo "==> syncing to off-host storage ($BACKUP_REMOTE)"
+  rclone copy "$BACKUP_DIR/db-${TIMESTAMP}.sql.gz" "$BACKUP_REMOTE/${ENVIRONMENT}/"
+  rclone copy "$BACKUP_DIR/uploads-${TIMESTAMP}.tar.gz" "$BACKUP_REMOTE/${ENVIRONMENT}/"
+else
+  echo "==> BACKUP_REMOTE not set — backup stayed local only; configure rclone before launch"
+fi
+
+echo "==> pruning local backups older than ${BACKUP_RETENTION_DAYS:-14} days"
+find "$BACKUP_DIR" -type f -mtime "+${BACKUP_RETENTION_DAYS:-14}" -delete
+
+echo "==> backup complete: $BACKUP_DIR"
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Builds and brings up an environment, then makes sure WordPress/WooCommerce
+# are installed and configured to match design doc §01/§03/§07. Safe to run
+# repeatedly — every step is idempotent.
+set -euo pipefail
+
+ENVIRONMENT="${1:?Usage: deploy.sh <dev|staging|production>}"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+case "$ENVIRONMENT" in
+  dev|staging|production) ;;
+  *) echo "environment must be 'dev', 'staging', or 'production'" >&2; exit 1 ;;
+esac
+
+ENV_FILE=".env.${ENVIRONMENT}"
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "missing $ENV_FILE — copy .env.example to $ENV_FILE and fill it in" >&2
+  exit 1
+fi
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+COMPOSE="docker compose -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+
+echo "==> building and starting ${ENVIRONMENT}"
+$COMPOSE up -d --build
+
+echo "==> waiting for the wordpress container to come up"
+for i in $(seq 1 30); do
+  if $COMPOSE exec -T wordpress php -v >/dev/null 2>&1; then
+    break
+  fi
+  if [[ "$i" -eq 30 ]]; then
+    echo "wordpress container did not become ready in time" >&2
+    exit 1
+  fi
+  sleep 2
+done
+
+echo "==> ensuring WordPress is installed"
+if ! $COMPOSE exec -T wordpress wp core is-installed --allow-root; then
+  $COMPOSE exec -T wordpress wp core install \
+    --url="${SITE_URL:?set SITE_URL in ${ENV_FILE}}" \
+    --title="${SITE_TITLE:-Bookstore}" \
+    --admin_user="${WP_ADMIN_USER:?set WP_ADMIN_USER in ${ENV_FILE}}" \
+    --admin_password="${WP_ADMIN_PASSWORD:?set WP_ADMIN_PASSWORD in ${ENV_FILE}}" \
+    --admin_email="${WP_ADMIN_EMAIL:?set WP_ADMIN_EMAIL in ${ENV_FILE}}" \
+    --skip-email \
+    --allow-root
+fi
+
+echo "==> installing/activating theme (Blocksy — free; Book Store starter site needs a manual license + import, see README)"
+$COMPOSE exec -T wordpress wp theme install blocksy --activate --allow-root
+
+echo "==> installing/activating required plugins"
+$COMPOSE exec -T wordpress wp plugin install woocommerce redis-cache blocksy-companion --activate --allow-root
+$COMPOSE exec -T wordpress wp plugin activate bookstore-core --allow-root
+$COMPOSE exec -T wordpress wp redis enable --allow-root || true
+
+echo "==> enabling WooCommerce HPOS (custom order tables)"
+$COMPOSE exec -T wordpress wp option update woocommerce_custom_orders_table_enabled yes --allow-root
+$COMPOSE exec -T wordpress wp option update woocommerce_custom_orders_table_data_sync_enabled yes --allow-root
+
+if [[ "$ENVIRONMENT" != "production" ]]; then
+  echo "==> discouraging search engines (non-production)"
+  $COMPOSE exec -T wordpress wp option update blog_public 0 --allow-root
+fi
+
+echo "==> flushing caches and rewrite rules"
+$COMPOSE exec -T wordpress wp cache flush --allow-root
+$COMPOSE exec -T wordpress wp rewrite flush --allow-root
+
+echo "==> deploy complete: ${ENVIRONMENT}"
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Install this at <bare-repo>.git/hooks/post-receive on your own Git server
+# (chmod +x it) and adjust DEPLOY_ROOT below. Pushing to `staging` deploys
+# to the staging checkout; pushing to `main` deploys to production.
+#
+#   git remote add origin <you>@<git-server>:/srv/git/bookstore.git
+#   git push origin staging
+#
+set -euo pipefail
+
+DEPLOY_ROOT="/srv/bookstore"
+
+while read -r oldrev newrev refname; do
+  branch="${refname#refs/heads/}"
+
+  case "$branch" in
+    staging)   target="$DEPLOY_ROOT/staging";    env="staging" ;;
+    main)      target="$DEPLOY_ROOT/production"; env="production" ;;
+    *)         echo "post-receive: ignoring push to $branch"; continue ;;
+  esac
+
+  echo "post-receive: deploying $branch -> $env ($target)"
+  mkdir -p "$target"
+  git --work-tree="$target" --git-dir="$(pwd)" checkout -f "$branch"
+  ( cd "$target" && ./deploy/deploy.sh "$env" )
+done
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Restores a backup INTO STAGING ONLY. Deliberately has no production path —
+# the launch gate is "a full backup has been restored into staging," never
+# production overwritten by a drill.
+set -euo pipefail
+
+DB_DUMP="${1:?Usage: restore.sh <db-dump.sql.gz> <uploads.tar.gz>}"
+UPLOADS_ARCHIVE="${2:?Usage: restore.sh <db-dump.sql.gz> <uploads.tar.gz>}"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+ENV_FILE=".env.staging"
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+COMPOSE="docker compose -f docker-compose.yml -f docker-compose.staging.yml --env-file ${ENV_FILE}"
+
+echo "!! this OVERWRITES the staging database and uploads !!"
+read -r -p "type 'restore' to continue: " confirm
+[[ "$confirm" == "restore" ]] || { echo "aborted"; exit 1; }
+
+echo "==> restoring database"
+gunzip -c "$DB_DUMP" | $COMPOSE exec -T db sh -c "exec mysql -u\"\$MARIADB_USER\" -p\"\$MARIADB_PASSWORD\" \"\$MARIADB_DATABASE\""
+
+echo "==> restoring uploads"
+ARCHIVE_DIR="$(cd "$(dirname "$UPLOADS_ARCHIVE")" && pwd)"
+ARCHIVE_NAME="$(basename "$UPLOADS_ARCHIVE")"
+$COMPOSE run --rm -T -v "${ARCHIVE_DIR}:/restore:ro" wordpress \
+  tar -xzf "/restore/${ARCHIVE_NAME}" -C /var/www/html/wp-content
+
+echo "==> restore complete — verify the site before treating the drill as passed"