twooeyandClaude Sonnet 5
8b149a672d
New WP_ADMIN_ALLOWED_IPS env var (space-separated CIDR ranges, matching Caddy's remote_ip syntax directly). Defaults to 0.0.0.0/0 ::/0 (today's open behavior) when unset, resolved at the Compose level rather than in the Caddyfile so an unset var can never leave `remote_ip` with zero arguments and fail Caddy's startup. admin-ajax.php stays exempt since WooCommerce routes logged-out storefront AJAX through it. Production only — staging is already LAN-only. Verified live: a scratch Caddy instance on a Docker network, with a sibling container's actual observed source IP used to prove both the blocked (403 on wp-admin/wp-login, everything else unaffected) and allowed (matching CIDR lets it through) cases, plus `docker compose config` to confirm the unset-var default resolves correctly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
x-env-type: &env-type
|
|
WP_ENVIRONMENT_TYPE: production
|
|
|
|
services:
|
|
wordpress:
|
|
environment: *env-type
|
|
|
|
cron:
|
|
environment: *env-type
|
|
|
|
caddy:
|
|
image: caddy:2-alpine
|
|
restart: unless-stopped
|
|
depends_on:
|
|
wordpress:
|
|
condition: service_healthy
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
environment:
|
|
SITE_DOMAIN: ${SITE_DOMAIN}
|
|
# Default keeps wp-admin open to everyone (today's behavior) when
|
|
# unset — resolved here, not in the Caddyfile, since Compose would
|
|
# otherwise pass an *empty* string rather than an unset var, and
|
|
# Caddy's own {$VAR:default} placeholder only applies to a var
|
|
# that's truly absent, not an empty one.
|
|
WP_ADMIN_ALLOWED_IPS: ${WP_ADMIN_ALLOWED_IPS:-0.0.0.0/0 ::/0}
|
|
volumes:
|
|
- ./docker/caddy/Caddyfile.production:/etc/caddy/Caddyfile:ro
|
|
- wp_core:/var/www/html:ro
|
|
- wp_uploads:/var/www/html/wp-content/uploads:ro
|
|
- wp_themes:/var/www/html/wp-content/themes:ro
|
|
- ./wp-content/plugins/bookstore-core:/var/www/html/wp-content/plugins/bookstore-core:ro
|
|
- caddy_data:/data
|
|
- caddy_config:/config
|
|
|
|
volumes:
|
|
caddy_data:
|
|
caddy_config:
|