@styleflow.app/flowpress-deploy 1.0.0-beta.2 → 1.0.0-beta.20

package/CHANGELOG.md

@@ -1,5 +1,116 @@
 # Changelog
 
+## 1.0.0-beta.20
+
+- Correct the local Apache Options directive and validate the development vhost with the real Apache server in the release gate.
+
+## 1.0.0-beta.19
+
+- Centralize full local development in flowpress-ops: profile-driven database, WordPress, hot-reload Astro and trusted HTTPS containers; preserve existing database volumes.
+- Keep Docker recipes in the package and generated runtime under ignored .local. Expose local start/stop/status/logs/exec/backup/datagrip commands.
+- Separate public HTTPS origins from internal development ports in the manifest.
+
+## 1.0.0-beta.18
+
+- Serialize JSON environment settings with native dotenv quoting so Node and PHP read valid frontend registries. Preserve unchanged private assignments verbatim.
+
+## 1.0.0-beta.17
+
+- Synchronize all four environment files and examples from the deployment manifest, preserving each environment’s private settings with protected backups. Retire legacy dev and provider variables.
+- Prepare cached development safelists without a remote CMS scan; strict builds still regenerate content classes.
+- Resolve explicit media origins from the selected backend, including production-backed previews.
+
+## 1.0.0-beta.16
+
+- Remove all persisted offload, SMTP and migration connection options from non-production clones; expose explicit integration cleanup for existing clones.
+- Align the JSON schema with supported backend aliases.
+
+## 1.0.0-beta.15
+
+- Export a Node fetch adapter for media proxies: negotiate identity encoding and remove encoding metadata after automatic decompression.
+- Verify gzip proxying against a real HTTP server.
+
+## 1.0.0-beta.14
+
+- Preserve provider timestamp offsets when waiting for backup completion.
+- Report WordPress staging as staging in the administration interface.
+- Remove disposable restore volumes after backup verification.
+
+## 1.0.0-beta.13
+
+- Remove disposable database volumes together with their test and transformation containers.
+
+- Activate the shared database only for installations that publish a CMS; frontend-only and preview-only profiles need no database engine.
+- Keep deployment history out of committed provider bindings, with a private local journal and authoritative registry metadata.
+
+
+## 1.0.0-beta.12
+
+- Keep CI on Coolify read/deploy permissions using verified environment image aliases. Derive current, rollback and promotion records from registry metadata instead of stale runner state. Provision frontend environment separately and bake SSR build identity into the image.
+
+- Make the sanitization script executable by WP-CLI eval-file and verify its production barrier with the real CLI.
+- Include WordPress GraphQL in CMS release health; optionally save command diagnostics in a private operator file.
+
+
+## 1.0.0-beta.11
+
+- Resolve platform server and panel references from the canonical infrastructure inventory.
+- Reuse an existing CMS image by commit SHA; refuse ambiguous registry failures instead of overwriting a release.
+- Verify status against the image configured in Coolify after CI deployments.
+
+
+## 1.0.0-beta.10
+
+- Keep local HTTP origins out of remote WordPress frontend registries.
+- Read the shared engine administrator secret from the operator configuration; never silently replace a missing pool password.
+
+
+## 1.0.0-beta.9
+
+- Keep editorial pages under /media/ available in static deployments; proxy only media files. Verify the behavior against a real Caddy runtime.
+
+
+## 1.0.0-beta.8
+
+- Exclude private backup files from media snapshots and reject them before uploads. Deny HTTP access to SQL dumps and migration backup directories.
+- Preserve existing schema backup bindings across repeated provisioning.
+
+
+## 1.0.0-beta.7
+
+- Preserve the local backend selection and explicit environment overrides used by isolated build fixtures. Stored environment URLs still defer to the manifest.
+
+
+## 1.0.0-beta.6
+
+- Encode MariaDB configuration for the Coolify API and preserve robot level when extending Harbor pull permissions.
+- Retain current and previous deployment aliases without changing immutable release tags.
+
+
+## 1.0.0-beta.5 — 2026-10-19
+
+- Use individually scoped system robots for repeatable Harbor provisioning; pass content build IDs to SSR health checks.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-piattaforma-container-flowpress.md).
+
+## 1.0.0-beta.4 — 2026-10-19
+
+- Add published FlowPress Ops CLI, readable deployment manifests, shared MariaDB bindings, reusable container runtimes, isolated environment loading, immutable releases, backup verification and on-demand preview.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-piattaforma-container-flowpress.md).
+
+## Unreleased
+
+- Agent rules only, no runtime or API change: `AGENTS.md` names the canonical
+  docs vault path (2026-10-18) and requires every published change to be
+  merged into `main`, with its branches, worktrees and stashes removed in the
+  same task.
+  [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-branch-residui-e-regole-di-chiusura.md).
+
+## 1.0.0-beta.3 — 2026-10-14
+
+- Queue complete builds for term-only changes to published content, including withdrawal after a visibility change. Keep unchanged assignments idle and avoid private data in the queue.
+- Verified public → private → public on disposable WordPress with all outbound HTTP intercepted.
+- [Canonical integration report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-14-consolidamento-tessari.md).
+
 ## 1.0.0-beta.2 — 2026-10-14
 
 - Automatic debounced editorial builds and public asset validation/history.

package/README.md

@@ -4,3 +4,8 @@ Official npm/Composer integration for FlowPress.
 
 - [Canonical guide](https://github.com/StyleFlow-App/styleflow-docs/blob/main/wiki/flowpress-routing-deploy.md)
 - [Release and verification report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-14-consolidamento-tessari.md)
+
+- [Container platform and FlowPress Ops](https://github.com/StyleFlow-App/styleflow-docs/blob/main/wiki/piattaforma-container-flowpress.md)
+
+The npm package also provides the flowpress-ops binary, reusable container
+recipes and the ./ops/environment API. Run flowpress-ops --help for commands.

package/containers/cms/Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1.7
+# The reusable PHP runtime is built once by platform build-base.
+ARG FLOWPRESS_PHP_IMAGE
+FROM $FLOWPRESS_PHP_IMAGE AS build
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
+WORKDIR /srv/cms
+COPY apps/cms/ ./
+RUN --mount=type=secret,id=composer_auth,required=true \
+    --mount=type=cache,target=/root/.composer/cache \
+    COMPOSER_AUTH="$(cat /run/secrets/composer_auth)" \
+    composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader --no-progress
+COPY --from=flowpress /cms/install-languages.sh /usr/local/bin/install-languages
+RUN sh /usr/local/bin/install-languages /srv/cms/web
+ARG WP_CLI_VERSION=2.12.0
+ARG WP_CLI_SHA256=ce34ddd838f7351d6759068d09793f26755463b4a4610a5a5c0a97b68220d85c
+RUN curl -fsSL "https://github.com/wp-cli/wp-cli/releases/download/v$WP_CLI_VERSION/wp-cli-$WP_CLI_VERSION.phar" -o /wp-cli.phar \
+ && echo "$WP_CLI_SHA256  /wp-cli.phar" | sha256sum -c - && chmod 755 /wp-cli.phar
+FROM $FLOWPRESS_PHP_IMAGE
+WORKDIR /srv/cms
+COPY --from=build /srv/cms/ ./
+COPY --from=build /wp-cli.phar /usr/local/bin/wp
+COPY --from=flowpress /cms/wp-cli.yml /srv/cms/wp-cli.yml
+COPY --from=flowpress /cms/healthz.php /srv/cms/web/healthz.php
+COPY --from=flowpress /cms/smtp.php /usr/local/share/flowpress-smtp.php
+RUN mkdir -p web/app/uploads web/app/webp-express web/app/cache web/app/upgrade \
+ && chown -R www-data:www-data web/app/uploads web/app/webp-express web/app/cache web/app/upgrade \
+ && echo 'auto_prepend_file=/usr/local/share/flowpress-smtp.php' > /usr/local/etc/php/conf.d/zz-smtp.ini
+ARG RELEASE_SHA=unknown
+ENV RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+USER www-data
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 CMD curl -fsS http://127.0.0.1:8080/healthz.php > /dev/null || exit 1
+CMD ["apache2-foreground"]

package/containers/cms/Dockerfile.dockerignore

@@ -0,0 +1,20 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+.styleflow
+apps/web
+packages
+docs
+apps/cms/vendor
+apps/cms/auth.json
+apps/cms/.env*
+apps/cms/web/wp
+apps/cms/web/app/plugins
+apps/cms/web/app/uploads
+apps/cms/web/app/webp-express
+apps/cms/web/app/cache
+apps/cms/web/app/upgrade
+apps/cms/web/app/mu-plugins/flowpress-*
+apps/cms/web/app/mu-plugins/flowpress-core

package/containers/cms/healthz.php

@@ -0,0 +1,17 @@
+<?php
+declare(strict_types=1);
+header('Content-Type: application/json');
+header('Cache-Control: no-store');
+try {
+    define('SHORTINIT', true);
+    require __DIR__ . '/wp/wp-load.php';
+    global $wpdb;
+    $installed = $wpdb->get_var("SELECT option_value FROM {$wpdb->options} WHERE option_name = 'siteurl'");
+    if (!$installed || !is_readable(__DIR__ . '/app/mu-plugins/flowpress-core/flowpress-core.php')) {
+        throw new RuntimeException('CMS not initialized.');
+    }
+    echo json_encode(['status' => 'ok', 'environment' => getenv('APP_ENV'), 'release' => getenv('RELEASE_SHA')]);
+} catch (Throwable $error) {
+    http_response_code(503);
+    echo json_encode(['status' => 'error', 'release' => getenv('RELEASE_SHA')]);
+}

package/containers/cms/install-languages.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Installs the Italian WordPress core translation matching the installed core.
+# Languages are gitignored and DISALLOW_FILE_MODS blocks installing them at
+# runtime, so they are part of the image.
+set -eu
+web_root="$1"
+version="$(php -r "include '$web_root/wp/wp-includes/version.php'; echo \$wp_version;")"
+package="$(curl -fsSL "https://api.wordpress.org/translations/core/1.0/?version=$version" \
+  | php -r '$d = json_decode(stream_get_contents(STDIN), true);
+            foreach ($d["translations"] ?? [] as $t) { if ($t["language"] === "it_IT") { echo $t["package"]; exit; } }
+            exit(1);')"
+mkdir -p "$web_root/app/languages"
+curl -fsSL "$package" -o /tmp/it_IT.zip
+unzip -oq /tmp/it_IT.zip -d "$web_root/app/languages"
+rm /tmp/it_IT.zip
+echo "Installed it_IT core translation for WordPress $version."

package/containers/cms/mpm.conf

@@ -0,0 +1,10 @@
+# Sized for a 1536m container limit: 8 workers at up to 256M PHP memory each,
+# typical WordPress requests use far less.
+<IfModule mpm_prefork_module>
+    StartServers             2
+    MinSpareServers          2
+    MaxSpareServers          4
+    ServerLimit              8
+    MaxRequestWorkers        8
+    MaxConnectionsPerChild 500
+</IfModule>

package/containers/cms/php.ini

@@ -0,0 +1,16 @@
+expose_php = Off
+display_errors = Off
+log_errors = On
+error_log = /proc/self/fd/2
+memory_limit = 256M
+upload_max_filesize = 64M
+post_max_size = 68M
+max_execution_time = 120
+max_input_vars = 3000
+session.save_path = /tmp
+; Code is immutable inside the image: never stat files for changes.
+opcache.enable = 1
+opcache.validate_timestamps = 0
+opcache.memory_consumption = 128
+opcache.interned_strings_buffer = 16
+opcache.max_accelerated_files = 20000

package/containers/cms/sanitize-integrations.php

@@ -0,0 +1,14 @@
+<?php
+if (getenv('FLOWPRESS_RUNTIME_POLICY') !== 'container' || getenv('APP_ENV') === 'production') {
+    throw new RuntimeException('Refusing to clean integrations in production.');
+}
+global $wpdb;
+$removed = 0;
+foreach ($wpdb->get_col("SELECT option_name FROM {$wpdb->options}") as $name) {
+    if (preg_match('/^(advmo_|wp_mail_smtp|wpmdb_|wp_migrate_)/', $name)) {
+        if (delete_option($name)) {
+            $removed++;
+        }
+    }
+}
+echo json_encode(['integrationOptionsRemoved' => $removed]) . "\n";

package/containers/cms/sanitize.php

@@ -0,0 +1,37 @@
+<?php
+// Executed only against a disposable copy, never against the source.
+if (getenv('FLOWPRESS_RUNTIME_POLICY') !== 'container' || getenv('APP_ENV') === 'production') {
+    throw new RuntimeException('Refusing to sanitize a production database.');
+}
+global $wpdb;
+foreach (get_users(['fields' => 'ID']) as $user_id) {
+    $wpdb->update($wpdb->users, ['user_pass' => wp_hash_password(wp_generate_password(64, true, true)), 'user_activation_key' => ''], ['ID' => $user_id]);
+    delete_user_meta((int) $user_id, 'session_tokens');
+    delete_user_meta((int) $user_id, '_application_passwords');
+}
+$plugins = get_option('active_plugins', []);
+update_option('active_plugins', array_values(array_filter($plugins, static fn (string $plugin): bool
+    => !preg_match('~^(advanced-media-offloader|wp-mail-smtp|wp-migrate-db-pro)/~', $plugin))));
+require __DIR__ . '/sanitize-integrations.php';
+foreach (['cron'] as $option) {
+    delete_option($option);
+}
+update_option('home', getenv('WP_HOME'));
+update_option('siteurl', getenv('WP_SITEURL'));
+update_option('blog_public', '0');
+$wpdb->query("DELETE FROM {$wpdb->options} WHERE option_name LIKE 'flowpress%queue%' OR option_name LIKE '%_transient_%'");
+$attachments = get_posts(['post_type' => 'attachment', 'post_status' => 'any', 'numberposts' => -1, 'fields' => 'ids']);
+foreach ($attachments as $id) {
+    $relative = get_post_meta($id, '_wp_attached_file', true);
+    if (is_string($relative) && $relative !== '' && !str_contains($relative, '..') && !str_contains($relative, '://')) {
+        $wpdb->update($wpdb->posts, ['guid' => rtrim(getenv('WP_HOME'), '/') . '/app/uploads/' . ltrim($relative, '/')], ['ID' => $id]);
+    }
+    foreach (array_keys(get_post_meta($id)) as $key) {
+        if (preg_match('/advmo|offload/i', $key)) delete_post_meta($id, $key);
+    }
+}
+echo json_encode([
+    'tables' => count($wpdb->get_col($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($wpdb->prefix) . '%'))),
+    'published' => (int) $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->posts} WHERE post_status='publish'"),
+    'attachments' => count($attachments),
+]) . "\n";

package/containers/cms/smtp.php

@@ -0,0 +1,13 @@
+<?php
+// Runs before Bedrock without reading any project file or persisted option.
+if (getenv('FLOWPRESS_RUNTIME_POLICY') === 'container' && getenv('FLOWPRESS_MAIL_MODE') === 'smtp' && getenv('APP_ENV') === 'production') {
+    foreach ([
+        'WPMS_ON' => true, 'WPMS_MAILER' => 'smtp',
+        'WPMS_SMTP_HOST' => getenv('SMTP_HOST'), 'WPMS_SMTP_PORT' => (int) getenv('SMTP_PORT'),
+        'WPMS_SMTP_SSL' => getenv('SMTP_ENCRYPTION'), 'WPMS_SMTP_AUTH' => true,
+        'WPMS_SMTP_USER' => getenv('SMTP_USER'), 'WPMS_SMTP_PASS' => getenv('SMTP_PASSWORD'),
+        'WPMS_MAIL_FROM' => getenv('SMTP_FROM'), 'WPMS_MAIL_FROM_NAME' => getenv('SMTP_FROM_NAME'),
+    ] as $key => $value) {
+        if (!defined($key)) define($key, $value);
+    }
+}

package/containers/cms/vhost.conf

@@ -0,0 +1,61 @@
+# Apache vhost for the container CMS. .htaccess files are ignored
+# (AllowOverride None): every rule WordPress needs is declared here.
+<VirtualHost *:8080>
+    ServerName localhost
+    DocumentRoot /srv/cms/web
+
+    <Directory /srv/cms/web>
+        AllowOverride None
+        Options +FollowSymLinks -Indexes
+        Require all granted
+        DirectoryIndex index.php
+
+        RewriteEngine On
+        # Application Passwords (cms:template) and Bearer callbacks need the
+        # Authorization header inside PHP.
+        RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+        RewriteRule ^index\.php$ - [L]
+        RewriteCond %{REQUEST_FILENAME} !-f
+        RewriteCond %{REQUEST_FILENAME} !-d
+        RewriteRule . /index.php [L]
+    </Directory>
+
+    # Uploaded files are data, never code.
+    <Directory /srv/cms/web/app/uploads>
+        <FilesMatch "(?i)\.(php[0-9]?|phtml|phar|pht|sql|sql\.gz|env|bak)$">
+            Require all denied
+        </FilesMatch>
+    </Directory>
+    <Directory /srv/cms/web/app/uploads/wp-migrate-db>
+        Require all denied
+    </Directory>
+    <FilesMatch "^\.|^(auth\.json|composer\.(json|lock)|wp-cli\.yml)$">
+        Require all denied
+    </FilesMatch>
+    <Files "xmlrpc.php">
+        Require all denied
+    </Files>
+
+    # Traefik (Docker network) sits in front; Cloudflare adds CF-Connecting-IP.
+    # Only the private proxy hop is trusted, see docs/wiki/deploy/07-sicurezza-e-accessi.md.
+    RemoteIPHeader CF-Connecting-IP
+    RemoteIPInternalProxy 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+    SetEnvIfNoCase X-Forwarded-Proto "^https$" HTTPS=on
+
+    <IfModule mod_expires.c>
+        ExpiresActive On
+        ExpiresByType image/webp "access plus 30 days"
+        ExpiresByType image/avif "access plus 30 days"
+        ExpiresByType image/jpeg "access plus 30 days"
+        ExpiresByType image/png "access plus 30 days"
+        ExpiresByType image/svg+xml "access plus 30 days"
+        ExpiresByType font/woff2 "access plus 1 year"
+    </IfModule>
+
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+
+    LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D" container
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 container
+</VirtualHost>

package/containers/cms/wp-cli.yml

@@ -0,0 +1 @@
+path: web/wp

package/containers/local/cms/Dockerfile

@@ -0,0 +1,18 @@
+FROM php:8.3-apache
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates default-mysql-client libicu-dev libjpeg62-turbo-dev \
+    libpng-dev libwebp-dev libzip-dev unzip webp \
+  && docker-php-ext-configure gd --with-jpeg --with-webp \
+  && docker-php-ext-install gd mysqli pdo_mysql intl opcache \
+  && a2enmod rewrite headers expires remoteip \
+  && echo "ServerName localhost" > /etc/apache2/conf-available/servername.conf \
+  && a2enconf servername \
+  && rm -rf /var/lib/apt/lists/*
+COPY local/cms/vhost.conf /etc/apache2/sites-available/000-default.conf
+COPY local/cms/php.ini /usr/local/etc/php/conf.d/zz-local.ini
+COPY local/cms/entrypoint.sh /usr/local/bin/flowpress-local-cms
+RUN chmod 755 /usr/local/bin/flowpress-local-cms
+WORKDIR /workspace/apps/cms/web
+ENTRYPOINT ["flowpress-local-cms"]
+CMD ["apache2-foreground"]

package/containers/local/cms/entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -eu
+if [ -r /certs/local-dev-root-ca.pem ]; then
+  cp /certs/local-dev-root-ca.pem /usr/local/share/ca-certificates/flowpress-local.crt
+  update-ca-certificates >/dev/null
+fi
+exec docker-php-entrypoint "$@"

package/containers/local/cms/php.ini

@@ -0,0 +1,8 @@
+upload_max_filesize = 128M
+post_max_size = 128M
+max_file_uploads = 200
+max_execution_time = 120
+display_errors = On
+display_startup_errors = On
+error_reporting = E_ALL
+log_errors = On

package/containers/local/cms/vhost.conf

@@ -0,0 +1,14 @@
+<VirtualHost *:80>
+    ServerName localhost
+    DocumentRoot /workspace/apps/cms/web
+    <Directory /workspace/apps/cms/web>
+        AllowOverride All
+        Options +FollowSymLinks -Indexes
+        Require all granted
+        DirectoryIndex index.php
+    </Directory>
+    RemoteIPHeader X-Forwarded-For
+    SetEnvIfNoCase X-Forwarded-Proto "^https$" HTTPS=on
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 combined
+</VirtualHost>

package/containers/local/web/Dockerfile

@@ -0,0 +1,8 @@
+FROM node:22.23.2-bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && corepack enable && corepack prepare pnpm@9.15.4 --activate
+COPY local/web/entrypoint.sh /usr/local/bin/flowpress-local-web
+RUN chmod 755 /usr/local/bin/flowpress-local-web
+WORKDIR /workspace
+ENTRYPOINT ["flowpress-local-web"]

package/containers/local/web/entrypoint.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+# Linux dependencies live in Docker volumes, separate from macOS node_modules.
+fingerprint="$(sha256sum pnpm-lock.yaml | cut -d ' ' -f 1)"
+stamp=node_modules/.flowpress-lock
+if [ ! -r "$stamp" ] || [ "$(cat "$stamp")" != "$fingerprint" ]; then
+  pnpm install --frozen-lockfile
+  printf '%s' "$fingerprint" > "$stamp"
+fi
+exec pnpm --filter "$FLOWPRESS_WEB_PACKAGE" dev --ignore-lock

package/containers/php-runtime/Dockerfile

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1.7
+FROM php:8.3-apache-bookworm
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates curl default-mysql-client libicu-dev libjpeg62-turbo-dev \
+    libpng-dev libwebp-dev libzip-dev unzip webp \
+ && docker-php-ext-configure gd --with-jpeg --with-webp \
+ && docker-php-ext-install exif gd intl mysqli opcache pdo_mysql zip \
+ && a2enmod expires headers remoteip rewrite \
+ && rm -rf /var/lib/apt/lists/*
+COPY cms/vhost.conf /etc/apache2/sites-available/000-default.conf
+COPY cms/mpm.conf /etc/apache2/mods-available/mpm_prefork.conf
+COPY cms/php.ini /usr/local/etc/php/conf.d/zz-container.ini
+RUN sed -i 's/^Listen 80$/Listen 8080/' /etc/apache2/ports.conf \
+ && sed -i '/Listen 443/d' /etc/apache2/ports.conf \
+ && echo 'ServerName localhost' > /etc/apache2/conf-available/servername.conf \
+ && a2enconf servername \
+ && mkdir -p /tmp/apache2 \
+ && chown www-data:www-data /tmp/apache2 \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+ENV APACHE_RUN_DIR=/tmp/apache2 APACHE_PID_FILE=/tmp/apache2/apache2.pid APACHE_LOCK_DIR=/tmp/apache2
+EXPOSE 8080

package/containers/web-ssr/Dockerfile

@@ -0,0 +1,27 @@
+# syntax=docker/dockerfile:1.7
+FROM node:22-bookworm-slim AS dependencies
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+WORKDIR /workspace
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
+COPY apps/web/package.json apps/web/package.json
+COPY apps/cms/package.json apps/cms/package.json
+COPY packages/ui packages/ui
+ARG WEB_PACKAGE
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm --filter $WEB_PACKAGE --prod deploy /deploy
+FROM node:22-bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl \
+ && rm -rf /var/lib/apt/lists/* \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+WORKDIR /srv/web
+COPY --from=dependencies /deploy/node_modules ./node_modules
+ARG DIST_DIR
+COPY $DIST_DIR/ ./dist/
+ARG RELEASE_SHA=unknown
+ARG FRONTEND_BUILD_ID=unknown
+ENV NODE_ENV=production HOST=0.0.0.0 PORT=8080 RELEASE_SHA=$RELEASE_SHA FRONTEND_BUILD_ID=$FRONTEND_BUILD_ID
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+LABEL app.flowpress.build-id=$FRONTEND_BUILD_ID
+USER node
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD curl -fsS http://127.0.0.1:8080/healthz.json > /dev/null || exit 1
+CMD ["node", "dist/server/entry.mjs"]

package/containers/web-ssr/Dockerfile.dockerignore

@@ -0,0 +1,10 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+apps/cms/vendor
+apps/cms/auth.json
+apps/cms/.env*
+apps/cms/web
+docs

package/containers/web-static/Caddyfile

@@ -0,0 +1,40 @@
+# Static production frontend. Cloudflare terminates TLS and caches at the edge;
+# Traefik forwards plain HTTP to port 8080.
+{
+	admin off
+	auto_https off
+	persist_config off
+	servers {
+		trusted_proxies static private_ranges
+	}
+}
+
+:8080 {
+	header X-Content-Type-Options nosniff
+	header Referrer-Policy strict-origin-when-cross-origin
+	@internal path /.container* /.flowpress* /.env* /server/*
+	respond @internal 404
+	root * /srv/site
+	encode zstd gzip
+
+	# Redirects, headers and media proxies generated from the Astro build.
+	import /srv/site/.container/routes.caddy
+
+	header /healthz.json Cache-Control "no-store"
+	header /_astro/* Cache-Control "public, max-age=31536000, immutable"
+	# HTML revalidates in browsers; Cloudflare keeps it at the edge until the
+	# deploy purge (see docs/wiki/deploy/06-cloudflare.md).
+	@html path / *.html */
+	header @html Cache-Control "public, max-age=0, must-revalidate"
+
+	file_server {
+		hide .container .flowpress-baseline.json .flowpress-fingerprint _redirects _headers _routes.json
+	}
+
+	handle_errors 404 {
+		header Cache-Control "no-store"
+		header CDN-Cache-Control "no-store"
+		rewrite * /404.html
+		file_server
+	}
+}

package/containers/web-static/Dockerfile

@@ -0,0 +1,17 @@
+# syntax=docker/dockerfile:1.7
+FROM caddy:2.10-alpine
+RUN apk add --no-cache libcap && setcap -r /usr/bin/caddy && apk del libcap \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+COPY --from=flowpress /web-static/Caddyfile /etc/caddy/Caddyfile
+ARG DIST_DIR
+COPY $DIST_DIR/ /srv/site/
+RUN test -f /srv/site/.container/routes.caddy && caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
+ARG RELEASE_SHA=unknown
+ARG FRONTEND_BUILD_ID=unknown
+ENV RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+LABEL app.flowpress.build-id=$FRONTEND_BUILD_ID
+USER 65534:65534
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz.json || exit 1
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/containers/web-static/Dockerfile.dockerignore

@@ -0,0 +1,7 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+apps/cms
+docs

package/dist/development.d.ts

@@ -0,0 +1,4 @@
+export function prepareDevelopmentSafelist(output: any, fallback: any): {
+    source: string;
+};
+//# sourceMappingURL=development.d.ts.map

package/dist/development.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"development.d.ts","sourceRoot":"","sources":["../src/development.js"],"names":[],"mappings":"AAIA;;EAIC"}

package/dist/development.js

@@ -0,0 +1,10 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+// Development must not scan every remote WordPress route before opening the
+// server. Strict builds still refresh the complete safelist from the CMS.
+export function prepareDevelopmentSafelist(output, fallback) {
+    const cached = existsSync(output) && readFileSync(output, "utf8").trim();
+    if (!cached)
+        writeFileSync(output, fallback);
+    return { source: cached ? "cache" : "structural" };
+}
+//# sourceMappingURL=development.js.map

package/dist/development.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"development.js","sourceRoot":"","sources":["../src/development.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAElE,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CAAC,MAAM,EAAE,QAAQ;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,IAAI,CAAC,MAAM;QAAE,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;AACrD,CAAC"}

package/dist/node-fetch.d.ts

@@ -0,0 +1,3 @@
+/** Fetch adapter for proxies running on Node, whose fetch decompresses bodies. */
+export declare const nodeProxyFetch: typeof fetch;
+//# sourceMappingURL=node-fetch.d.ts.map

package/dist/node-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-fetch.d.ts","sourceRoot":"","sources":["../src/node-fetch.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,eAAO,MAAM,cAAc,EAAE,OAAO,KAgBnC,CAAC"}

package/dist/node-fetch.js

@@ -0,0 +1,20 @@
+/** Fetch adapter for proxies running on Node, whose fetch decompresses bodies. */
+export const nodeProxyFetch = async (input, init) => {
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+    headers.set("accept-encoding", "identity");
+    const response = await fetch(input, { ...init, headers });
+    const encoding = response.headers.get("content-encoding")?.trim().toLowerCase();
+    const method = init?.method ?? (input instanceof Request ? input.method : "GET");
+    if (method === "HEAD" || !response.body || !encoding || !/^(gzip|deflate|br)$/.test(encoding))
+        return response;
+    // A server ignoring identity negotiation must not label decoded bytes as gzip.
+    if (response.status === 206) {
+        await response.body.cancel();
+        throw new Error("Encoded partial media response cannot be proxied safely.");
+    }
+    const decodedHeaders = new Headers(response.headers);
+    decodedHeaders.delete("content-encoding");
+    decodedHeaders.delete("content-length");
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers: decodedHeaders });
+};
+//# sourceMappingURL=node-fetch.js.map