twooey/bookstore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove staging basic-auth wall — box is LAN-only

Browse Source 
Staging runs on a private-network VM, not reachable from outside, so the
HTTP basic-auth layer was unnecessary defense-in-depth. Removing it also
lets the Caddyfile drop the render-around-Compose workaround entirely
(that workaround existed specifically because Compose's interpolation
mangles a bcrypt hash) — the noindex header and blog_public=0 stay, since
those guard against search-engine indexing, a separate concern from
network-level access.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
twooey
2026-08-27 11:23:35 -04:00
co-authored by Claude Sonnet 5
parent b43852e733
commit cd48f85a47
6 changed files with 11 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/deploy.sh
-13
View File
@@ -32,19 +32,6 @@ WP_ADMIN_EMAIL="$(env_get "$ENV_FILE" WP_ADMIN_EMAIL)"
# reuse dev's db_data volume/credentials the first time this ran).
COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
if [[ "$ENVIRONMENT" == "staging" ]]; then
echo "==> rendering Caddyfile.staging (basic-auth hash bypasses compose entirely)"
mkdir -p docker/caddy/.generated
AUTH_USER="$(env_get "$ENV_FILE" STAGING_BASIC_AUTH_USER)"
AUTH_HASH="$(env_get "$ENV_FILE" STAGING_BASIC_AUTH_HASH)"
: "${AUTH_USER:?set STAGING_BASIC_AUTH_USER in ${ENV_FILE}}"
: "${AUTH_HASH:?set STAGING_BASIC_AUTH_HASH in ${ENV_FILE} — see .env.example for how to generate it}"
TEMPLATE="$(cat docker/caddy/Caddyfile.staging)"
TEMPLATE="${TEMPLATE//__STAGING_BASIC_AUTH_USER__/$AUTH_USER}"
TEMPLATE="${TEMPLATE//__STAGING_BASIC_AUTH_HASH__/$AUTH_HASH}"
printf '%s\n' "$TEMPLATE" > docker/caddy/.generated/Caddyfile.staging
fi
echo "==> building and starting ${ENVIRONMENT}"
$COMPOSE up -d --build