twooey/bookstore
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
31 Commits 2 Branches 0 Tags
main
Commit Graph
3 Commits
Author SHA1 Message Date
twooeyandClaude Sonnet 5 8b149a672d Restrict production wp-admin/wp-login to an IP allowlist (opt-in) 
New WP_ADMIN_ALLOWED_IPS env var (space-separated CIDR ranges, matching
Caddy's remote_ip syntax directly). Defaults to 0.0.0.0/0 ::/0 (today's
open behavior) when unset, resolved at the Compose level rather than in
the Caddyfile so an unset var can never leave `remote_ip` with zero
arguments and fail Caddy's startup. admin-ajax.php stays exempt since
WooCommerce routes logged-out storefront AJAX through it. Production
only — staging is already LAN-only.

Verified live: a scratch Caddy instance on a Docker network, with a
sibling container's actual observed source IP used to prove both the
blocked (403 on wp-admin/wp-login, everything else unaffected) and
allowed (matching CIDR lets it through) cases, plus `docker compose
config` to confirm the unset-var default resolves correctly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg
 2026-08-28 11:15:55 -04:00
twooeyandClaude Sonnet 5 3143128798 Block web access to bookstore-core's tests/vendor/composer files 
They're bind-mounted straight into the webroot (docker-compose.*.yml) and
nothing strips them on a git-checkout deploy, so php_fastcgi/file_server
would otherwise execute/serve them directly. 404 instead of 403 so their
existence isn't confirmed. Verified live against a scratch Caddy instance
— plain `*` matches across path segments in Caddy 2.11.4 (the `**` token
I first tried did not match nested paths at all).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg
 2026-08-28 11:11:11 -04:00
twooeyandClaude Sonnet 5 c9d637c907 Week 1 infrastructure: Docker environments, deploy pipeline, bookstore-core scaffold 
Docker Compose environments for dev/staging/production (MariaDB, Redis,
Caddy, Action Scheduler cron sidecar), an idempotent deploy script,
git-hook-based deploy pipeline, backup/restore scripts, and the
bookstore-core plugin stub with WooCommerce HPOS compatibility declared.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-08-27 09:50:18 -04:00