twooeyandClaude Sonnet 5
3876a6ba30
The reported bug (a generated password containing "$BRjTx3tlmSpz" got
silently blanked, breaking the DB connection) is the same Compose
interpolation issue as the earlier bcrypt hash, but this time in fields
that are genuinely user-chosen and can't just be avoided by convention.
Switched DB_PASSWORD/DB_ROOT_PASSWORD to Docker's official `_FILE`
secrets convention (MARIADB_PASSWORD_FILE / WORDPRESS_DB_PASSWORD_FILE),
backed by Compose's native `secrets:` mechanism: deploy.sh writes the raw
value to secrets/<env>/db_password, and the container reads that file
directly — the value never passes through Compose's ${VAR} interpolation
at all. Verified end-to-end with an actual `$`-containing password,
including a full deploy → backup → restore → still-serving round trip.
Also fixed along the way (found while actually testing, not assumed):
- Makefile never exported ENVIRONMENT, so `make up` alone (bypassing
deploy.sh) would have left the new secrets path unresolved.
- deploy.sh chmod'd the secret files 600, unreadable by the container's
own UID (www-data) — fixed to 644, relying on the containing directory
(700) to keep other host users out instead.
- backup.sh/restore.sh still called `mysqldump`/`mysql`, which don't
exist in the mariadb:11 image under those names — renamed to
mariadb-dump/mariadb. (This means neither script had actually
succeeded before now; both are verified working end-to-end here.)
The supplier/payment API keys remain passed the old way — nothing reads
them yet (bookstore-core is still a stub), so there's no live bug to fix
there; noted in .env.example that the same _FILE pattern should be used
once that code exists.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
31 lines
517 B
Makefile
31 lines
517 B
Makefile
ENV ?= dev
|
|
export ENVIRONMENT = $(ENV)
|
|
COMPOSE = docker compose -p bookstore-$(ENV) -f docker-compose.yml -f docker-compose.$(ENV).yml --env-file .env.$(ENV)
|
|
|
|
.PHONY: up down ps logs shell wp deploy backup
|
|
|
|
up:
|
|
$(COMPOSE) up -d --build
|
|
|
|
down:
|
|
$(COMPOSE) down
|
|
|
|
ps:
|
|
$(COMPOSE) ps
|
|
|
|
logs:
|
|
$(COMPOSE) logs -f
|
|
|
|
shell:
|
|
$(COMPOSE) exec wordpress bash
|
|
|
|
# make wp ENV=staging ARGS="plugin list"
|
|
wp:
|
|
$(COMPOSE) exec wordpress wp $(ARGS) --allow-root
|
|
|
|
deploy:
|
|
./deploy/deploy.sh $(ENV)
|
|
|
|
backup:
|
|
./deploy/backup.sh $(ENV)
|