fix: Riotkit entrypoint was not set up at all in new installations

Author: B&R

Dockerfile

@@ -47,7 +47,7 @@ RUN apk --update add nginx apache2-utils rsync less \
     && chown www-data:www-data /var/tmp/nginx/ /var/lib/nginx/tmp/ -R \
     && chmod +x /usr/bin/wp
 
-ADD ./wp-config-sample.php /usr/src/wordpress/wp-config-sample.php
+ADD ./wp-config-sample.php /usr/src/wordpress/wp-config.php
 ADD ./wp-config-riotkit.php /usr/src/wordpress/wp-config-riotkit.php
 ADD ./liveness.php /usr/src/wordpress/liveness.php
 ADD ./readiness.php /usr/src/wordpress/readiness.php

container-files/entrypoint.sh

@@ -7,41 +7,36 @@ gid="$(id -g)"
 echo " >> UID=${uid}, GID=${gid}"
 
 if ([ ! -e index.php ] && [ ! -e wp-includes/version.php ]) || [[ "${FORCE_UPGRADE}" == "true" ]]; then
-        args=( "--exclude" "readme.html" "--exclude" "*.txt" )
+        args=( "--exclude" "readme.html" "--exclude" "*.txt" "--exclude" "wp-content" )
 
-        echo >&2 "WordPress not found in $PWD - copying now..."
+        echo >&2 " >> WordPress not found in $PWD - copying now..."
         if [ -n "$(find -mindepth 1 -maxdepth 1 -not -name wp-content)" ]; then
                 echo >&2 "WARNING: $PWD is not empty! (copying anyhow)"
         fi
 
-        if [[ ! -z "$(ls -A /var/www/riotkit/wp-content)" ]]; then
-            args+=( "--exclude" "wp-content" )
+        echo >&2 " >> Running rsync, additional args: ${args[@]}"
+        rsync -av /usr/src/wordpress/* /var/www/riotkit "${args[@]}"
+
+        # does not exist OR is empty
+        if [[ ! -d /var/www/riotkit/wp-content ]] || [[ ! -z "$(ls -A /var/www/riotkit/wp-content)" ]]; then
+            echo >&2 " >> Syncing wp-content as it does not exists or is empty"
+            mkdir -p /usr/src/wordpress/wp-content || true
+
+            # do not set owner/group/time on a volume mount to avoid non-root permission denied
+            rsync -av --no-o --no-g --no-t --no-p /usr/src/wordpress/wp-content/* /var/www/riotkit/wp-content
         fi
 
-        echo "Running rsync, additional args: ${args}"
-        rsync -av --no-o --no-g --no-t --no-p /usr/src/wordpress/* /var/www/riotkit "${args[@]}"
-        echo >&2 "Complete! WordPress has been successfully copied to $PWD"
+        echo >&2 " >> YAY! WordPress has been successfully copied to $PWD"
 fi
 
-wpEnvs=( "${!WORDPRESS_@}" )
-if [ ! -s wp-config.php ] && [ "${#wpEnvs[@]}" -gt 0 ]; then
-        for wpConfigDocker in \
-                wp-config-docker.php \
-                /usr/src/wordpress/wp-config-docker.php \
-        ; do
-                if [ -s "$wpConfigDocker" ]; then
-                        echo >&2 "No 'wp-config.php' found in $PWD, but 'WORDPRESS_...' variables supplied; copying '$wpConfigDocker' (${wpEnvs[*]})"
-                        # using "awk" to replace all instances of "put your unique phrase here" with a properly unique string (for AUTH_KEY and friends to have safe defaults if they aren't specified with environment variables)
-                        awk '
-                                /put your unique phrase here/ {
-                                        cmd = "head -c1m /dev/urandom | sha1sum | cut -d\\  -f1"
-                                        cmd | getline str
-                                        close(cmd)
-                                        gsub("put your unique phrase here", str)
-                                }
-                                { print }
-                        ' "$wpConfigDocker" > wp-config.php
-                        break
-                fi
-        done
-fi
+echo " >> Filling up wp-config.php"
+wpConfigContent=$(cat wp-config.php)
+echo "${wpConfigContent}" | awk '
+        /put your unique phrase here/ {
+                cmd = "head -c1m /dev/urandom | sha1sum | cut -d\\  -f1"
+                cmd | getline str
+                close(cmd)
+                gsub("put your unique phrase here", str)
+        }
+        { print }
+' > wp-config.php

helm/wordpress-hardened/templates/deployment.yaml

@@ -59,6 +59,10 @@ spec:
             tolerations:
                 {{- toYaml . | nindent 14 }}
             {{- end }}
+
+            # ================================================================
+            #  Init Container for fixing permissions
+            # ================================================================
             initContainers:
             {{ if .Values.chownInitContainer.enabled }}
                 - name: set-volume-permissions
@@ -72,6 +76,9 @@ spec:
                       {{ include "wordpress-hardened.mounts" . | nindent 22  }}
             {{ end }}
             containers:
+                # ================================================================
+                #  Web Application Firewall (WAF) support
+                # ================================================================
                 {{- if .Values.waf.enabled }}
                 - name: waf-proxy
                   image: {{ .Values.waf.image.repository }}:{{ .Values.waf.image.tag }}
@@ -125,6 +132,9 @@ spec:
                   {{- end }}
                 {{- end }}
 
+                # ================================================================
+                #  WordPress container
+                # ================================================================
                 - name: app
                   image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
                   imagePullPolicy: Always
@@ -138,7 +148,7 @@ spec:
 
                       {{- if not (hasKey .Values.env "WP_PAGE_URL") }}
                       - name: WP_PAGE_URL
-                        value: "http{{ if eq .Values.wordpress.https "on" }}s{{ end }}://{{ .Values.wordpress.domain }}{{ if not (eq .Values.wordpress.publicPort "443") }}:{{ .Values.wordpress.publicPort }}{{ end }}"
+                        value: "http{{ if eq .Values.wordpress.https "on" }}s{{ end }}://{{ .Values.wordpress.domain }}{{ if not (eq (.Values.wordpress.publicPort | toString) "443") }}:{{ .Values.wordpress.publicPort }}{{ end }}"
                       {{- end }}
 
                       {{- if not (hasKey .Values.env "HEALTH_CHECK_ALLOWED_SUBNET") }}