Containers, Docker and Kubernetes

# syntax=docker/dockerfile:1

# Stage 1: build the blocks of lumen-catalog with @wordpress/scripts.
FROM node:24.21.0-alpine3.24 AS blocks
WORKDIR /build
COPY plugins/lumen-catalog/package.json plugins/lumen-catalog/package-lock.json ./
RUN npm ci --no-audit --no-fund
COPY plugins/lumen-catalog/src/blocks ./src/blocks
RUN npm run build

# Stage 2: production Composer dependencies and an authoritative class map.
FROM composer:2.10.3 AS vendor
WORKDIR /build
COPY plugins/lumen-catalog/composer.json plugins/lumen-catalog/composer.lock ./
RUN composer install --no-dev --no-autoloader --no-interaction --no-progress
COPY plugins/lumen-catalog/src ./src
RUN rm -rf src/blocks && composer dump-autoload --no-dev --classmap-authoritative

# Stage 3: the runtime image, with WordPress served from /usr/src/wordpress.
FROM wordpress:7.1.3-php8.4-apache
WORKDIR /usr/src/wordpress
RUN set -eux; \
	find /etc/apache2 -name '*.conf' -type f -exec sed -ri \
		-e "s!/var/www/html!$PWD!g" -e "s!Directory /var/www/!Directory $PWD!g" '{}' +; \
	sed -i "/That's all, stop editing/i define( 'DISALLOW_FILE_MODS', true );" wp-config-docker.php; \
	cp -s wp-config-docker.php wp-config.php; \
	rm -rf wp-content/plugins/akismet wp-content/plugins/hello.php; \
	mkdir -p wp-content/uploads; \
	chown -R root:root .; \
	chown www-data:www-data wp-content/uploads

COPY --from=wordpress:cli-2.12.0-php8.4 /usr/local/bin/wp /usr/local/bin/wp
COPY docker/zz-lumen.ini $PHP_INI_DIR/conf.d/
COPY docker/healthz.php ./healthz.php

COPY plugins/lumen-catalog/lumen-catalog.php plugins/lumen-catalog/uninstall.php \
	plugins/lumen-catalog/readme.txt wp-content/plugins/lumen-catalog/
COPY plugins/lumen-catalog/languages wp-content/plugins/lumen-catalog/languages
COPY --from=vendor /build/src wp-content/plugins/lumen-catalog/src
COPY --from=vendor /build/vendor wp-content/plugins/lumen-catalog/vendor
COPY --from=blocks /build/build wp-content/plugins/lumen-catalog/build
COPY themes/lumen wp-content/themes/lumen

VOLUME /usr/src/wordpress/wp-content/uploads
ENV WP_ENVIRONMENT_TYPE=production
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
	CMD curl -fsS -o /dev/null http://127.0.0.1/healthz.php || exit 1

name: lumen-prod

x-wordpress: &wordpress
  image: lumen-press:0.1.0
  read_only: true
  tmpfs: [/tmp, /run]
  environment:
    WORDPRESS_DB_HOST: db
    WORDPRESS_DB_NAME: lumen
    WORDPRESS_DB_USER: lumen
    WORDPRESS_DB_PASSWORD_FILE: /run/secrets/db_password
    WORDPRESS_TABLE_PREFIX: lp_
    WORDPRESS_AUTH_KEY_FILE: /run/secrets/wp_auth_key
    WORDPRESS_SECURE_AUTH_KEY_FILE: /run/secrets/wp_secure_auth_key
    WORDPRESS_LOGGED_IN_KEY_FILE: /run/secrets/wp_logged_in_key
    WORDPRESS_NONCE_KEY_FILE: /run/secrets/wp_nonce_key
    WORDPRESS_AUTH_SALT_FILE: /run/secrets/wp_auth_salt
    WORDPRESS_SECURE_AUTH_SALT_FILE: /run/secrets/wp_secure_auth_salt
    WORDPRESS_LOGGED_IN_SALT_FILE: /run/secrets/wp_logged_in_salt
    WORDPRESS_NONCE_SALT_FILE: /run/secrets/wp_nonce_salt
    WP_ENVIRONMENT_TYPE: production
    # Evaluated by wp-config.php on every request, so every service needs it.
    WORDPRESS_CONFIG_EXTRA: |
      define( 'WP_HOME', 'https://lumenpress.example' );
      define( 'WP_SITEURL', 'https://lumenpress.example' );
      define( 'DISABLE_WP_CRON', true );
  secrets: [db_password, wp_auth_key, wp_secure_auth_key, wp_logged_in_key, wp_nonce_key,
            wp_auth_salt, wp_secure_auth_salt, wp_logged_in_salt, wp_nonce_salt]
  volumes:
    - uploads:/usr/src/wordpress/wp-content/uploads
  depends_on:
    db:
      condition: service_healthy

services:
  db:
    image: mariadb:11.8
    environment:
      MARIADB_DATABASE: lumen
      MARIADB_USER: lumen
      MARIADB_PASSWORD_FILE: /run/secrets/db_password
      MARIADB_RANDOM_ROOT_PASSWORD: "1"
    secrets: [db_password]
    volumes:
      - db-data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      retries: 10
    restart: unless-stopped

  web:
    <<: *wordpress
    ports:
      - "127.0.0.1:8080:80"   # the TLS-terminating proxy runs on the host
    restart: unless-stopped

  cron:
    <<: *wordpress
    user: "33:33"
    entrypoint: ["/bin/sh", "-c"]
    command:
      - while true; do wp cron event run --due-now --quiet; sleep 60; done
    healthcheck:
      disable: true
    restart: unless-stopped

  cli:
    <<: *wordpress
    user: "33:33"
    entrypoint: ["wp"]
    profiles: ["tools"]

volumes:
  db-data:
  uploads:

secrets:
  db_password:         { file: ./secrets/db_password.txt }
  wp_auth_key:         { file: ./secrets/wp_auth_key.txt }
  wp_secure_auth_key:  { file: ./secrets/wp_secure_auth_key.txt }
  wp_logged_in_key:    { file: ./secrets/wp_logged_in_key.txt }
  wp_nonce_key:        { file: ./secrets/wp_nonce_key.txt }
  wp_auth_salt:        { file: ./secrets/wp_auth_salt.txt }
  wp_secure_auth_salt: { file: ./secrets/wp_secure_auth_salt.txt }
  wp_logged_in_salt:   { file: ./secrets/wp_logged_in_salt.txt }
  wp_nonce_salt:       { file: ./secrets/wp_nonce_salt.txt }

kubectl create namespace lumen
kubectl create secret generic lumen-wordpress --namespace lumen --from-file=secrets/

apiVersion: v1
kind: ConfigMap
metadata: { name: lumen-wordpress, namespace: lumen }
data:
  WORDPRESS_DB_HOST: db.lumenpress.internal
  WORDPRESS_DB_NAME: lumen
  WORDPRESS_DB_USER: lumen
  WORDPRESS_TABLE_PREFIX: lp_
  WP_ENVIRONMENT_TYPE: production
  WORDPRESS_DB_PASSWORD_FILE: /run/secrets/lumen/db-password
  WORDPRESS_AUTH_KEY_FILE: /run/secrets/lumen/auth-key
  WORDPRESS_SECURE_AUTH_KEY_FILE: /run/secrets/lumen/secure-auth-key
  WORDPRESS_LOGGED_IN_KEY_FILE: /run/secrets/lumen/logged-in-key
  WORDPRESS_NONCE_KEY_FILE: /run/secrets/lumen/nonce-key
  WORDPRESS_AUTH_SALT_FILE: /run/secrets/lumen/auth-salt
  WORDPRESS_SECURE_AUTH_SALT_FILE: /run/secrets/lumen/secure-auth-salt
  WORDPRESS_LOGGED_IN_SALT_FILE: /run/secrets/lumen/logged-in-salt
  WORDPRESS_NONCE_SALT_FILE: /run/secrets/lumen/nonce-salt
  WORDPRESS_CONFIG_EXTRA: |
    define( 'WP_HOME', 'https://lumenpress.example' );
    define( 'WP_SITEURL', 'https://lumenpress.example' );
    define( 'FORCE_SSL_ADMIN', true );
    define( 'DISABLE_WP_CRON', true );
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: lumen-uploads, namespace: lumen }
spec:
  accessModes: ["ReadWriteMany"]
  storageClassName: shared-files
  resources: { requests: { storage: 50Gi } }

apiVersion: apps/v1
kind: Deployment
metadata: { name: lumen-web, namespace: lumen }
spec:
  replicas: 2
  selector: { matchLabels: { app.kubernetes.io/name: lumen-web } }
  template:
    metadata: { labels: { app.kubernetes.io/name: lumen-web } }
    spec:
      containers:
        - name: wordpress
          image: registry.lumenpress.example/lumen-press:0.1.0
          ports: [{ name: http, containerPort: 80 }]
          envFrom: [{ configMapRef: { name: lumen-wordpress } }]
          securityContext: { readOnlyRootFilesystem: true, allowPrivilegeEscalation: false }
          resources:
            requests: { cpu: 250m, memory: 256Mi }
            limits: { memory: 512Mi }
          startupProbe:
            httpGet: { path: /healthz.php, port: http }
            periodSeconds: 2
            failureThreshold: 30
          livenessProbe:
            httpGet: { path: /healthz.php, port: http }
          readinessProbe:
            httpGet:
              path: /wp-login.php
              port: http
              httpHeaders: [{ name: X-Forwarded-Proto, value: https }]
            timeoutSeconds: 5
          volumeMounts:
            - { name: secrets, mountPath: /run/secrets/lumen, readOnly: true }
            - { name: uploads, mountPath: /usr/src/wordpress/wp-content/uploads }
            - { name: tmp, mountPath: /tmp }
            - { name: run, mountPath: /run }
      volumes:
        - { name: secrets, secret: { secretName: lumen-wordpress } }
        - { name: uploads, persistentVolumeClaim: { claimName: lumen-uploads } }
        - { name: tmp, emptyDir: {} }
        - { name: run, emptyDir: {} }
---
apiVersion: v1
kind: Service
metadata: { name: lumen-web, namespace: lumen }
spec:
  selector: { app.kubernetes.io/name: lumen-web }
  ports: [{ name: http, port: 80, targetPort: http }]
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata: { name: lumen-web, namespace: lumen }
spec:
  ingressClassName: traefik
  tls: [{ hosts: ["lumenpress.example"], secretName: lumenpress-example-tls }]
  rules:
    - host: lumenpress.example
      http:
        paths:
          - path: /
            pathType: Prefix
            backend: { service: { name: lumen-web, port: { name: http } } }

apiVersion: batch/v1
kind: CronJob
metadata: { name: lumen-cron, namespace: lumen }
spec:
  schedule: "* * * * *"
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 50
  successfulJobsHistoryLimit: 1
  jobTemplate:
    spec:
      backoffLimit: 0
      activeDeadlineSeconds: 600
      template:
        spec:
          restartPolicy: Never
          securityContext: { runAsUser: 33, runAsGroup: 33, runAsNonRoot: true }
          containers:
            - name: wp-cron
              image: registry.lumenpress.example/lumen-press:0.1.0
              command: ["wp", "cron", "event", "run", "--due-now", "--quiet"]
              envFrom: [{ configMapRef: { name: lumen-wordpress } }]
              env: [{ name: HOME, value: /tmp }]
              securityContext: { readOnlyRootFilesystem: true, allowPrivilegeEscalation: false }
              volumeMounts:
                - { name: secrets, mountPath: /run/secrets/lumen, readOnly: true }
                - { name: uploads, mountPath: /usr/src/wordpress/wp-content/uploads }
                - { name: tmp, mountPath: /tmp }
          volumes:
            - { name: secrets, secret: { secretName: lumen-wordpress } }
            - { name: uploads, persistentVolumeClaim: { claimName: lumen-uploads } }
            - { name: tmp, emptyDir: {} }