Containerized setup based on Bedrock

.dockerignore

@@ -0,0 +1,13 @@
+# ignore everything by default
+*
+
+# copy these directories
+!bin/
+!docker/fairpm-wordpress
+
+# copy these files
+!.env
+!README.md
+!composer.json
+!composer.lock
+

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{js,json,yml}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

.env.example

@@ -0,0 +1,18 @@
+DATABASE_URL='mysql://wp:password@fairpm-db:3306/wordpress'
+DB_PREFIX='wp_'
+
+WP_ENV='development'
+WP_HOME='https://local.fair.pm'
+WP_SITEURL="${WP_HOME}/wp"
+
+# WP_DEBUG_LOG='/path/to/debug.log'
+
+###> Do not remove this comment, and do not add anything under it, as it will be replaced on install <###
+AUTH_KEY='generateme'
+SECURE_AUTH_KEY='generateme'
+LOGGED_IN_KEY='generateme'
+NONCE_KEY='generateme'
+AUTH_SALT='generateme'
+SECURE_AUTH_SALT='generateme'
+LOGGED_IN_SALT='generateme'
+NONCE_SALT='generateme'

.github/workflows/build.yml

@@ -2,11 +2,7 @@ name: Build and push container
 
 on:
   push:
-    branches: [ main ]
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
+    tags: [ 'v*' ]
 
 jobs:
   build:
@@ -16,31 +12,34 @@ jobs:
       packages: write
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    - name: Log in to Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.REGISTRY }}
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Build and push
-      run: bin/build.sh
-
-    - name: Build Summary
-      if: always()
-      run: |
-        echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
-        echo "- Commit: ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
-        echo "- Branch: ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
-        echo "- Status: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
-
-    - name: Upload build artifacts
-      if: failure()
-      uses: actions/upload-artifact@v4
-      with:
-        name: build-logs
-        path: /tmp/fairserver-build/
-        retention-days: 7
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Build and push
+        run: bin/build-and-push
+        env:
+          DOCKERFILE: docker/fairpm-wordpress/Dockerfile
+          IMAGE_NAME: ${{ github.repository }}
+          TAG: ${{ github.event.release.tag_name }}
+          REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build Summary
+        if: always()
+        run: |
+          echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
+          echo "- Commit: ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Branch: ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Status: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+
+      - name: Upload build artifacts
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-logs
+          path: /tmp/fairserver-build/
+          retention-days: 7

.gitignore

@@ -1,21 +1,26 @@
-.env.production
-gp-data/
+#### ignore all dotfiles and dot-dirs, with exceptions
+.*
+!.config/
+!.distignore
+!.dockerignore
+!.editorconfig
+!.env.example
+!.gitattributes
+!.gitignore
 
-# Installed via Composer
-content/mu-plugins/php-basic-auth/
-content/plugins/aws-ses-wp-mail/
-content/plugins/fair-plugin/
-content/plugins/git-updater/
-content/plugins/query-monitor/
-content/plugins/wp-redis/
-content/plugins/mini-fair-repo/
-content/plugins/aspireexplorer/
-content/plugins/public-post-preview/
-content/plugins/wordpress-seo/
-content/plugins/wordpress-seo-premium/
-content/themes/fair-parent-theme/
-content/plugins/fair-beacon/
-content/plugins/glotpress-wp/
-content/plugins/s3-uploads/
-vendor/
-wordpress/
+#### ignore these patterns
+*.bak
+*.log
+*.tmp
+*.local
+*.local.*
+*.secret
+*.secret.*
+
+#### ignore these specific directories
+/gp-data/
+/vendor/
+
+#### ignore these specific files
+auth.json
+docker-compose.override.yml

README.md

@@ -1,32 +1,26 @@
-# Server
+# fair.pm web site
 
-This is the overarching repo for the code deployed to our hosted server, running at https://fair.pm/
+This is the overarching repo for the code deployed to our hosted server, running at https://fair.pm/.  It will eventually form a template repository for wordpress installations in general, but for now it's specifically configured for the fair.pm site.
 
+## Quick Start for Local Development
 
-## Local Development
-
-This repository is pre-configured with wp-env configuration. (Better Docker Compose setup coming soon!)
-
-You can set up a local environment using:
-
-```sh
-# First, install Composer dependencies.
-composer install
-
-# Then, start an environment.
-npx @wordpress/env start
+```
+bin/init
+bin/up
 ```
 
+## Local Development 
 
-## Deployment
+The fair.pm server is built on the [Roots Bedrock](https://roots.io/bedrock/) distribution of WordPress, so all plugins and themes are managed via Composer.
 
-Deployment will eventually be automatic, but in the meantime, the infrastructure team needs to deploy the repository via Helm. Ping them when deployment is needed.
+Local development is primarily based on Docker containers, using a FrankenPHP web server container for WordPress, with other support containers defined in `docker-compose.yml`.  The default configuration is to expose the server through Traefik at https://local.fair.pm (which always resolves to localhost), but local ports can be used instead by renaming the `docker-compose.override.example.yml` file to `docker-compose.override.yml` and editing it to your needs.
 
-To ignore files from deployment, specify them in `.distignore`.
+## Deployment
 
+TODO
 
 ## License
 
 Licensed under the GNU General Public License, v2 or later. Copyright 2025 contributors.
 
-Incorporates code from [WordPress/wordpress.org](https://github.com/WordPress/wordpress.org). Licensed under the GNU General Public License, v2 or later. Copyright 2025 contributors.
+Incorporates code from [WordPress](https://github.com/WordPress/wordpress.org) and [Roots Bedrock](https://github.com/roots/bedrock). Licensed under the GNU General Public License, v2 or later. Copyright 2025 contributors.

bin/build-and-push

@@ -0,0 +1,37 @@
+#!/bin/bash
+# shellcheck disable=SC2086
+
+set -euxo pipefail
+
+here=$(dirname "$0")
+cd "$here/.."
+
+image=${IMAGE_NAME?required argument missing}
+dockerfile=${DOCKERFILE:-Dockerfile}
+tag=${TAG:-$(git describe --tags --abbrev=0)}
+platform=${PLATFORM:-linux/amd64,linux/arm64}
+target=${TARGET:-prod}
+
+registry=${REGISTRY:-ghcr.io}
+username=${REGISTRY_USERNAME:-required-but-ignored-on-ghcr}
+password=${REGISTRY_PASSWORD:-${GITHUB_TOKEN:-}}
+
+main () {
+    push_arg=''
+
+    if [[ -n ${password:-} ]]; then
+        echo "$password" | docker login "$registry" -u "$username" --password-stdin
+        push_arg='--push'
+    fi
+
+    docker buildx build \
+        --file "$dockerfile" \
+        --target "$target" \
+        --platform "$platform" \
+        --tag "ghcr.io/$image:$tag" \
+        --tag "ghcr.io/$image:latest" \
+        $push_arg \
+        .
+}
+
+main "$@"