@styleflow.app/flowpress-deploy 1.0.0-beta.3 → 1.0.0-beta.30

package/CHANGELOG.md

@@ -1,5 +1,161 @@
 # Changelog
 
+## 1.0.0-beta.30 — 2026-10-21
+
+- Mantiene il contratto TypeScript `Record<string, string>` degli ambienti dopo il filtraggio delle credenziali media; verifica le dichiarazioni pubblicate con un consumer TypeScript. Corregge beta.29 prima dell’adozione DMO.
+- [Rapporto canonico](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-21-storage-condiviso-manuale-flowpress.md).
+
+## 1.0.0-beta.29 — 2026-10-21
+
+- Importazioni condivise conservano metadati e percorsi soltanto con namespace sorgente/destinazione verificato; nessuna credenziale media nel container di trasformazione DB.
+- Manifest media v2 per sei provider, override ambientali completi e lettura dei manifest v1.
+- Migrazione esplicita con anteprima e copia privata; credenziali native soltanto nel CMS e verifica di coerenza degli URL.
+- Comandi `media status` e `media check` senza scritture sul bucket e senza valori segreti; richiede Core beta.38.
+- [Rapporto canonico](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-21-storage-condiviso-manuale-flowpress.md).
+
+## 1.0.0-beta.28
+
+- Verify restored local backups against the persisted database home when WP_HOME is overridden by the environment. Active CMS identity remains checked separately before planning and applying.
+
+
+## 1.0.0-beta.27 — 2026-10-20
+
+- Use WP-CLI `eval-file -` for stdin migration programs; /dev/stdin is not readable in the DMO container.
+- Exercise the exact stdin program through real WP-CLI before publication.
+- Keep the protocol status output concise.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-20-sync-site-editor-ritiro-legacy.md).
+
+## 1.0.0-beta.26 — 2026-10-20
+
+- Correct Linux ownership cleanup in the WordPress migration integration fixture; beta.25 tag failed CI before publication and remains immutable.
+- Own Site Editor sync protocol 1, manifest-aware targets, feature operations and explicit backed-up pilot-alias migrations.
+- Retire the Scaffold dependency in operational checks and share development helpers.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-20-sync-site-editor-ritiro-legacy.md).
+
+## 1.0.0-beta.24
+
+- Keep local clean --apply --json machine-readable by capturing Docker removal output. Verify the real CLI JSON response against Docker fixtures.
+
+## 1.0.0-beta.23
+
+- Share digest-pinned native CMS and web runtimes across local projects, built once in CI for ARM64/AMD64 and verified before npm publication.
+- Add read-only local storage inventory and explicit image cleanup with container/reference protection; preserve volumes and global caches.
+- Require --push or --load for deployment image builds; stop implicit AMD64 image loading on development machines.
+
+## 1.0.0-beta.22
+
+- Preserve stdout from local exec and streaming commands so maintenance tools can consume WP-CLI JSON without CLI status text.
+
+## 1.0.0-beta.21
+
+- Preserve shell variables through Compose interpolation and use a variable-free PHP readiness probe. Verify the generated Compose configuration and probe syntax through the real CLI.
+- Isolate CMS workspace dependencies and Vite caches in Docker volumes, start the StyleFlow build/watch cycle, and allow the initial Astro compilation to complete before declaring the frontend unhealthy.
+
+## 1.0.0-beta.20
+
+- Correct the local Apache Options directive and validate the development vhost with the real Apache server in the release gate.
+
+## 1.0.0-beta.19
+
+- Centralize full local development in flowpress-ops: profile-driven database, WordPress, hot-reload Astro and trusted HTTPS containers; preserve existing database volumes.
+- Keep Docker recipes in the package and generated runtime under ignored .local. Expose local start/stop/status/logs/exec/backup/datagrip commands.
+- Separate public HTTPS origins from internal development ports in the manifest.
+
+## 1.0.0-beta.18
+
+- Serialize JSON environment settings with native dotenv quoting so Node and PHP read valid frontend registries. Preserve unchanged private assignments verbatim.
+
+## 1.0.0-beta.17
+
+- Synchronize all four environment files and examples from the deployment manifest, preserving each environment’s private settings with protected backups. Retire legacy dev and provider variables.
+- Prepare cached development safelists without a remote CMS scan; strict builds still regenerate content classes.
+- Resolve explicit media origins from the selected backend, including production-backed previews.
+
+## 1.0.0-beta.16
+
+- Remove all persisted offload, SMTP and migration connection options from non-production clones; expose explicit integration cleanup for existing clones.
+- Align the JSON schema with supported backend aliases.
+
+## 1.0.0-beta.15
+
+- Export a Node fetch adapter for media proxies: negotiate identity encoding and remove encoding metadata after automatic decompression.
+- Verify gzip proxying against a real HTTP server.
+
+## 1.0.0-beta.14
+
+- Preserve provider timestamp offsets when waiting for backup completion.
+- Report WordPress staging as staging in the administration interface.
+- Remove disposable restore volumes after backup verification.
+
+## 1.0.0-beta.13
+
+- Remove disposable database volumes together with their test and transformation containers.
+
+- Activate the shared database only for installations that publish a CMS; frontend-only and preview-only profiles need no database engine.
+- Keep deployment history out of committed provider bindings, with a private local journal and authoritative registry metadata.
+
+
+## 1.0.0-beta.12
+
+- Keep CI on Coolify read/deploy permissions using verified environment image aliases. Derive current, rollback and promotion records from registry metadata instead of stale runner state. Provision frontend environment separately and bake SSR build identity into the image.
+
+- Make the sanitization script executable by WP-CLI eval-file and verify its production barrier with the real CLI.
+- Include WordPress GraphQL in CMS release health; optionally save command diagnostics in a private operator file.
+
+
+## 1.0.0-beta.11
+
+- Resolve platform server and panel references from the canonical infrastructure inventory.
+- Reuse an existing CMS image by commit SHA; refuse ambiguous registry failures instead of overwriting a release.
+- Verify status against the image configured in Coolify after CI deployments.
+
+
+## 1.0.0-beta.10
+
+- Keep local HTTP origins out of remote WordPress frontend registries.
+- Read the shared engine administrator secret from the operator configuration; never silently replace a missing pool password.
+
+
+## 1.0.0-beta.9
+
+- Keep editorial pages under /media/ available in static deployments; proxy only media files. Verify the behavior against a real Caddy runtime.
+
+
+## 1.0.0-beta.8
+
+- Exclude private backup files from media snapshots and reject them before uploads. Deny HTTP access to SQL dumps and migration backup directories.
+- Preserve existing schema backup bindings across repeated provisioning.
+
+
+## 1.0.0-beta.7
+
+- Preserve the local backend selection and explicit environment overrides used by isolated build fixtures. Stored environment URLs still defer to the manifest.
+
+
+## 1.0.0-beta.6
+
+- Encode MariaDB configuration for the Coolify API and preserve robot level when extending Harbor pull permissions.
+- Retain current and previous deployment aliases without changing immutable release tags.
+
+
+## 1.0.0-beta.5 — 2026-10-19
+
+- Use individually scoped system robots for repeatable Harbor provisioning; pass content build IDs to SSR health checks.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-piattaforma-container-flowpress.md).
+
+## 1.0.0-beta.4 — 2026-10-19
+
+- Add published FlowPress Ops CLI, readable deployment manifests, shared MariaDB bindings, reusable container runtimes, isolated environment loading, immutable releases, backup verification and on-demand preview.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-piattaforma-container-flowpress.md).
+
+## Unreleased
+
+- Agent rules only, no runtime or API change: `AGENTS.md` names the canonical
+  docs vault path (2026-10-18) and requires every published change to be
+  merged into `main`, with its branches, worktrees and stashes removed in the
+  same task.
+  [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-branch-residui-e-regole-di-chiusura.md).
+
 ## 1.0.0-beta.3 — 2026-10-14
 
 - Queue complete builds for term-only changes to published content, including withdrawal after a visibility change. Keep unchanged assignments idle and avoid private data in the queue.

package/README.md

@@ -4,3 +4,8 @@ Official npm/Composer integration for FlowPress.
 
 - [Canonical guide](https://github.com/StyleFlow-App/styleflow-docs/blob/main/wiki/flowpress-routing-deploy.md)
 - [Release and verification report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-14-consolidamento-tessari.md)
+
+- [Container platform and FlowPress Ops](https://github.com/StyleFlow-App/styleflow-docs/blob/main/wiki/piattaforma-container-flowpress.md)
+
+The npm package also provides the flowpress-ops binary, reusable container
+recipes and the ./ops/environment API. Run flowpress-ops --help for commands.

package/composer.json

@@ -5,7 +5,7 @@
   "license": "proprietary",
   "require": {
     "php": ">=8.1",
-    "flowpress/wordpress-core": "^1.0.0@beta"
+    "flowpress/wordpress-core": "^1.0.0-beta.38"
   },
   "extra": {"installer-name": "flowpress-deploy"}
 }

package/containers/cms/Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1.7
+# The reusable PHP runtime is built once by platform build-base.
+ARG FLOWPRESS_PHP_IMAGE
+FROM $FLOWPRESS_PHP_IMAGE AS build
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
+WORKDIR /srv/cms
+COPY apps/cms/ ./
+RUN --mount=type=secret,id=composer_auth,required=true \
+    --mount=type=cache,target=/root/.composer/cache \
+    COMPOSER_AUTH="$(cat /run/secrets/composer_auth)" \
+    composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader --no-progress
+COPY --from=flowpress /cms/install-languages.sh /usr/local/bin/install-languages
+RUN sh /usr/local/bin/install-languages /srv/cms/web
+ARG WP_CLI_VERSION=2.12.0
+ARG WP_CLI_SHA256=ce34ddd838f7351d6759068d09793f26755463b4a4610a5a5c0a97b68220d85c
+RUN curl -fsSL "https://github.com/wp-cli/wp-cli/releases/download/v$WP_CLI_VERSION/wp-cli-$WP_CLI_VERSION.phar" -o /wp-cli.phar \
+ && echo "$WP_CLI_SHA256  /wp-cli.phar" | sha256sum -c - && chmod 755 /wp-cli.phar
+FROM $FLOWPRESS_PHP_IMAGE
+WORKDIR /srv/cms
+COPY --from=build /srv/cms/ ./
+COPY --from=build /wp-cli.phar /usr/local/bin/wp
+COPY --from=flowpress /cms/wp-cli.yml /srv/cms/wp-cli.yml
+COPY --from=flowpress /cms/healthz.php /srv/cms/web/healthz.php
+COPY --from=flowpress /cms/smtp.php /usr/local/share/flowpress-smtp.php
+RUN mkdir -p web/app/uploads web/app/webp-express web/app/cache web/app/upgrade \
+ && chown -R www-data:www-data web/app/uploads web/app/webp-express web/app/cache web/app/upgrade \
+ && echo 'auto_prepend_file=/usr/local/share/flowpress-smtp.php' > /usr/local/etc/php/conf.d/zz-smtp.ini
+ARG RELEASE_SHA=unknown
+ENV RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+USER www-data
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 CMD curl -fsS http://127.0.0.1:8080/healthz.php > /dev/null || exit 1
+CMD ["apache2-foreground"]

package/containers/cms/Dockerfile.dockerignore

@@ -0,0 +1,20 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+.styleflow
+apps/web
+packages
+docs
+apps/cms/vendor
+apps/cms/auth.json
+apps/cms/.env*
+apps/cms/web/wp
+apps/cms/web/app/plugins
+apps/cms/web/app/uploads
+apps/cms/web/app/webp-express
+apps/cms/web/app/cache
+apps/cms/web/app/upgrade
+apps/cms/web/app/mu-plugins/flowpress-*
+apps/cms/web/app/mu-plugins/flowpress-core

package/containers/cms/healthz.php

@@ -0,0 +1,17 @@
+<?php
+declare(strict_types=1);
+header('Content-Type: application/json');
+header('Cache-Control: no-store');
+try {
+    define('SHORTINIT', true);
+    require __DIR__ . '/wp/wp-load.php';
+    global $wpdb;
+    $installed = $wpdb->get_var("SELECT option_value FROM {$wpdb->options} WHERE option_name = 'siteurl'");
+    if (!$installed || !is_readable(__DIR__ . '/app/mu-plugins/flowpress-core/flowpress-core.php')) {
+        throw new RuntimeException('CMS not initialized.');
+    }
+    echo json_encode(['status' => 'ok', 'environment' => getenv('APP_ENV'), 'release' => getenv('RELEASE_SHA')]);
+} catch (Throwable $error) {
+    http_response_code(503);
+    echo json_encode(['status' => 'error', 'release' => getenv('RELEASE_SHA')]);
+}

package/containers/cms/install-languages.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Installs the Italian WordPress core translation matching the installed core.
+# Languages are gitignored and DISALLOW_FILE_MODS blocks installing them at
+# runtime, so they are part of the image.
+set -eu
+web_root="$1"
+version="$(php -r "include '$web_root/wp/wp-includes/version.php'; echo \$wp_version;")"
+package="$(curl -fsSL "https://api.wordpress.org/translations/core/1.0/?version=$version" \
+  | php -r '$d = json_decode(stream_get_contents(STDIN), true);
+            foreach ($d["translations"] ?? [] as $t) { if ($t["language"] === "it_IT") { echo $t["package"]; exit; } }
+            exit(1);')"
+mkdir -p "$web_root/app/languages"
+curl -fsSL "$package" -o /tmp/it_IT.zip
+unzip -oq /tmp/it_IT.zip -d "$web_root/app/languages"
+rm /tmp/it_IT.zip
+echo "Installed it_IT core translation for WordPress $version."

package/containers/cms/mpm.conf

@@ -0,0 +1,10 @@
+# Sized for a 1536m container limit: 8 workers at up to 256M PHP memory each,
+# typical WordPress requests use far less.
+<IfModule mpm_prefork_module>
+    StartServers             2
+    MinSpareServers          2
+    MaxSpareServers          4
+    ServerLimit              8
+    MaxRequestWorkers        8
+    MaxConnectionsPerChild 500
+</IfModule>

package/containers/cms/php.ini

@@ -0,0 +1,16 @@
+expose_php = Off
+display_errors = Off
+log_errors = On
+error_log = /proc/self/fd/2
+memory_limit = 256M
+upload_max_filesize = 64M
+post_max_size = 68M
+max_execution_time = 120
+max_input_vars = 3000
+session.save_path = /tmp
+; Code is immutable inside the image: never stat files for changes.
+opcache.enable = 1
+opcache.validate_timestamps = 0
+opcache.memory_consumption = 128
+opcache.interned_strings_buffer = 16
+opcache.max_accelerated_files = 20000

package/containers/cms/sanitize-integrations.php

@@ -0,0 +1,14 @@
+<?php
+if (getenv('FLOWPRESS_RUNTIME_POLICY') !== 'container' || getenv('APP_ENV') === 'production') {
+    throw new RuntimeException('Refusing to clean integrations in production.');
+}
+global $wpdb;
+$removed = 0;
+foreach ($wpdb->get_col("SELECT option_name FROM {$wpdb->options}") as $name) {
+    if (preg_match('/^(advmo_|wp_mail_smtp|wpmdb_|wp_migrate_)/', $name)) {
+        if (delete_option($name)) {
+            $removed++;
+        }
+    }
+}
+echo json_encode(['integrationOptionsRemoved' => $removed]) . "\n";

package/containers/cms/sanitize.php

@@ -0,0 +1,40 @@
+<?php
+// Executed only against a disposable copy, never against the source.
+if (getenv('FLOWPRESS_RUNTIME_POLICY') !== 'container' || getenv('APP_ENV') === 'production') {
+    throw new RuntimeException('Refusing to sanitize a production database.');
+}
+global $wpdb;
+foreach (get_users(['fields' => 'ID']) as $user_id) {
+    $wpdb->update($wpdb->users, ['user_pass' => wp_hash_password(wp_generate_password(64, true, true)), 'user_activation_key' => ''], ['ID' => $user_id]);
+    delete_user_meta((int) $user_id, 'session_tokens');
+    delete_user_meta((int) $user_id, '_application_passwords');
+}
+$plugins = get_option('active_plugins', []);
+update_option('active_plugins', array_values(array_filter($plugins, static fn (string $plugin): bool
+    => !preg_match('~^(advanced-media-offloader|wp-mail-smtp|wp-migrate-db-pro)/~', $plugin))));
+require __DIR__ . '/sanitize-integrations.php';
+foreach (['cron'] as $option) {
+    delete_option($option);
+}
+update_option('home', getenv('WP_HOME'));
+update_option('siteurl', getenv('WP_SITEURL'));
+update_option('blog_public', '0');
+$wpdb->query("DELETE FROM {$wpdb->options} WHERE option_name LIKE 'flowpress%queue%' OR option_name LIKE '%_transient_%'");
+$attachments = get_posts(['post_type' => 'attachment', 'post_status' => 'any', 'numberposts' => -1, 'fields' => 'ids']);
+foreach ($attachments as $id) {
+    // Shared cloud paths belong to both databases. Never rewrite existing keys.
+    if (getenv('FLOWPRESS_MEDIA_IMPORT_PRESERVE') === 'true') continue;
+    $relative = get_post_meta($id, '_wp_attached_file', true);
+    if (is_string($relative) && $relative !== '' && !str_contains($relative, '..') && !str_contains($relative, '://')) {
+        $wpdb->update($wpdb->posts, ['guid' => rtrim(getenv('WP_HOME'), '/') . '/app/uploads/' . ltrim($relative, '/')], ['ID' => $id]);
+        clean_post_cache($id);
+    }
+    foreach (array_keys(get_post_meta($id)) as $key) {
+        if (preg_match('/advmo|offload/i', $key)) delete_post_meta($id, $key);
+    }
+}
+echo json_encode([
+    'tables' => count($wpdb->get_col($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($wpdb->prefix) . '%'))),
+    'published' => (int) $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->posts} WHERE post_status='publish'"),
+    'attachments' => count($attachments),
+]) . "\n";

package/containers/cms/smtp.php

@@ -0,0 +1,13 @@
+<?php
+// Runs before Bedrock without reading any project file or persisted option.
+if (getenv('FLOWPRESS_RUNTIME_POLICY') === 'container' && getenv('FLOWPRESS_MAIL_MODE') === 'smtp' && getenv('APP_ENV') === 'production') {
+    foreach ([
+        'WPMS_ON' => true, 'WPMS_MAILER' => 'smtp',
+        'WPMS_SMTP_HOST' => getenv('SMTP_HOST'), 'WPMS_SMTP_PORT' => (int) getenv('SMTP_PORT'),
+        'WPMS_SMTP_SSL' => getenv('SMTP_ENCRYPTION'), 'WPMS_SMTP_AUTH' => true,
+        'WPMS_SMTP_USER' => getenv('SMTP_USER'), 'WPMS_SMTP_PASS' => getenv('SMTP_PASSWORD'),
+        'WPMS_MAIL_FROM' => getenv('SMTP_FROM'), 'WPMS_MAIL_FROM_NAME' => getenv('SMTP_FROM_NAME'),
+    ] as $key => $value) {
+        if (!defined($key)) define($key, $value);
+    }
+}

package/containers/cms/vhost.conf

@@ -0,0 +1,61 @@
+# Apache vhost for the container CMS. .htaccess files are ignored
+# (AllowOverride None): every rule WordPress needs is declared here.
+<VirtualHost *:8080>
+    ServerName localhost
+    DocumentRoot /srv/cms/web
+
+    <Directory /srv/cms/web>
+        AllowOverride None
+        Options +FollowSymLinks -Indexes
+        Require all granted
+        DirectoryIndex index.php
+
+        RewriteEngine On
+        # Application Passwords (cms:template) and Bearer callbacks need the
+        # Authorization header inside PHP.
+        RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+        RewriteRule ^index\.php$ - [L]
+        RewriteCond %{REQUEST_FILENAME} !-f
+        RewriteCond %{REQUEST_FILENAME} !-d
+        RewriteRule . /index.php [L]
+    </Directory>
+
+    # Uploaded files are data, never code.
+    <Directory /srv/cms/web/app/uploads>
+        <FilesMatch "(?i)\.(php[0-9]?|phtml|phar|pht|sql|sql\.gz|env|bak)$">
+            Require all denied
+        </FilesMatch>
+    </Directory>
+    <Directory /srv/cms/web/app/uploads/wp-migrate-db>
+        Require all denied
+    </Directory>
+    <FilesMatch "^\.|^(auth\.json|composer\.(json|lock)|wp-cli\.yml)$">
+        Require all denied
+    </FilesMatch>
+    <Files "xmlrpc.php">
+        Require all denied
+    </Files>
+
+    # Traefik (Docker network) sits in front; Cloudflare adds CF-Connecting-IP.
+    # Only the private proxy hop is trusted, see docs/wiki/deploy/07-sicurezza-e-accessi.md.
+    RemoteIPHeader CF-Connecting-IP
+    RemoteIPInternalProxy 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+    SetEnvIfNoCase X-Forwarded-Proto "^https$" HTTPS=on
+
+    <IfModule mod_expires.c>
+        ExpiresActive On
+        ExpiresByType image/webp "access plus 30 days"
+        ExpiresByType image/avif "access plus 30 days"
+        ExpiresByType image/jpeg "access plus 30 days"
+        ExpiresByType image/png "access plus 30 days"
+        ExpiresByType image/svg+xml "access plus 30 days"
+        ExpiresByType font/woff2 "access plus 1 year"
+    </IfModule>
+
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+
+    LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D" container
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 container
+</VirtualHost>

package/containers/cms/wp-cli.yml

@@ -0,0 +1 @@
+path: web/wp

package/containers/local/cms/Dockerfile

@@ -0,0 +1,18 @@
+FROM php:8.3-apache@sha256:f8506a19d79cad7fcf0c8049f1ed2208824961018fdc10bd80f324094dcd36bd
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates default-mysql-client libicu-dev libjpeg62-turbo-dev \
+    libpng-dev libwebp-dev libzip-dev unzip webp \
+  && docker-php-ext-configure gd --with-jpeg --with-webp \
+  && docker-php-ext-install gd mysqli pdo_mysql intl opcache \
+  && a2enmod rewrite headers expires remoteip \
+  && echo "ServerName localhost" > /etc/apache2/conf-available/servername.conf \
+  && a2enconf servername \
+  && rm -rf /var/lib/apt/lists/*
+COPY local/cms/vhost.conf /etc/apache2/sites-available/000-default.conf
+COPY local/cms/php.ini /usr/local/etc/php/conf.d/zz-local.ini
+COPY local/cms/entrypoint.sh /usr/local/bin/flowpress-local-cms
+RUN chmod 755 /usr/local/bin/flowpress-local-cms
+WORKDIR /workspace/apps/cms/web
+ENTRYPOINT ["flowpress-local-cms"]
+CMD ["apache2-foreground"]

package/containers/local/cms/entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -eu
+if [ -r /certs/local-dev-root-ca.pem ]; then
+  cp /certs/local-dev-root-ca.pem /usr/local/share/ca-certificates/flowpress-local.crt
+  update-ca-certificates >/dev/null
+fi
+exec docker-php-entrypoint "$@"

package/containers/local/cms/php.ini

@@ -0,0 +1,8 @@
+upload_max_filesize = 128M
+post_max_size = 128M
+max_file_uploads = 200
+max_execution_time = 120
+display_errors = On
+display_startup_errors = On
+error_reporting = E_ALL
+log_errors = On

package/containers/local/cms/vhost.conf

@@ -0,0 +1,14 @@
+<VirtualHost *:80>
+    ServerName localhost
+    DocumentRoot /workspace/apps/cms/web
+    <Directory /workspace/apps/cms/web>
+        AllowOverride All
+        Options +FollowSymLinks -Indexes
+        Require all granted
+        DirectoryIndex index.php
+    </Directory>
+    RemoteIPHeader X-Forwarded-For
+    SetEnvIfNoCase X-Forwarded-Proto "^https$" HTTPS=on
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 combined
+</VirtualHost>

package/containers/local/runtimes.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "repository": "registry.smxapp.com/flowpress",
+  "runtimes": {
+    "cms": {
+      "recipe": "0dc3ad5f81ebab17d71d9ad3aeee38f4058a9aab400cfffbd888c34582dc8b50",
+      "digest": "sha256:a792ce4c3e9f8942feef09f95f8319febf9e299c1f613c986982905cafdd2f2f"
+    },
+    "web": {
+      "recipe": "58c57037535b075c5d31b03fbbb1ff69c9c19acb9a6c4eb7cc53145980b219a5",
+      "digest": "sha256:3455c31d6c56444f0142ea1330b33bc1ae4ab67efc66ce103ca96c59012d4a74"
+    }
+  }
+}

package/containers/local/web/Dockerfile

@@ -0,0 +1,8 @@
+FROM node:22.23.2-bookworm-slim@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && corepack enable && corepack prepare pnpm@9.15.4 --activate
+COPY local/web/entrypoint.sh /usr/local/bin/flowpress-local-web
+RUN chmod 755 /usr/local/bin/flowpress-local-web
+WORKDIR /workspace
+ENTRYPOINT ["flowpress-local-web"]

package/containers/local/web/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+# Linux dependencies live in Docker volumes, separate from macOS node_modules.
+fingerprint="$(sha256sum pnpm-lock.yaml | cut -d ' ' -f 1)"
+stamp=node_modules/.flowpress-lock
+if [ ! -r "$stamp" ] || [ "$(cat "$stamp")" != "$fingerprint" ]; then
+  pnpm install --frozen-lockfile
+  printf '%s' "$fingerprint" > "$stamp"
+fi
+pnpm --if-present styleflow:build
+pnpm --if-present components:check
+pnpm --if-present styleflow:watch &
+watcher=$!
+pnpm --filter "$FLOWPRESS_WEB_PACKAGE" dev --ignore-lock &
+frontend=$!
+trap 'kill "$frontend" "$watcher" 2>/dev/null || true; wait || true' EXIT
+trap 'exit 0' INT TERM
+while kill -0 "$frontend" 2>/dev/null; do
+  sleep 1
+done
+exit 1

package/containers/php-runtime/Dockerfile

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1.7
+FROM php:8.3-apache-bookworm
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates curl default-mysql-client libicu-dev libjpeg62-turbo-dev \
+    libpng-dev libwebp-dev libzip-dev unzip webp \
+ && docker-php-ext-configure gd --with-jpeg --with-webp \
+ && docker-php-ext-install exif gd intl mysqli opcache pdo_mysql zip \
+ && a2enmod expires headers remoteip rewrite \
+ && rm -rf /var/lib/apt/lists/*
+COPY cms/vhost.conf /etc/apache2/sites-available/000-default.conf
+COPY cms/mpm.conf /etc/apache2/mods-available/mpm_prefork.conf
+COPY cms/php.ini /usr/local/etc/php/conf.d/zz-container.ini
+RUN sed -i 's/^Listen 80$/Listen 8080/' /etc/apache2/ports.conf \
+ && sed -i '/Listen 443/d' /etc/apache2/ports.conf \
+ && echo 'ServerName localhost' > /etc/apache2/conf-available/servername.conf \
+ && a2enconf servername \
+ && mkdir -p /tmp/apache2 \
+ && chown www-data:www-data /tmp/apache2 \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+ENV APACHE_RUN_DIR=/tmp/apache2 APACHE_PID_FILE=/tmp/apache2/apache2.pid APACHE_LOCK_DIR=/tmp/apache2
+EXPOSE 8080

package/containers/web-ssr/Dockerfile

@@ -0,0 +1,27 @@
+# syntax=docker/dockerfile:1.7
+FROM node:22-bookworm-slim AS dependencies
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+WORKDIR /workspace
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
+COPY apps/web/package.json apps/web/package.json
+COPY apps/cms/package.json apps/cms/package.json
+COPY packages/ui packages/ui
+ARG WEB_PACKAGE
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm --filter $WEB_PACKAGE --prod deploy /deploy
+FROM node:22-bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl \
+ && rm -rf /var/lib/apt/lists/* \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+WORKDIR /srv/web
+COPY --from=dependencies /deploy/node_modules ./node_modules
+ARG DIST_DIR
+COPY $DIST_DIR/ ./dist/
+ARG RELEASE_SHA=unknown
+ARG FRONTEND_BUILD_ID=unknown
+ENV NODE_ENV=production HOST=0.0.0.0 PORT=8080 RELEASE_SHA=$RELEASE_SHA FRONTEND_BUILD_ID=$FRONTEND_BUILD_ID
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+LABEL app.flowpress.build-id=$FRONTEND_BUILD_ID
+USER node
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD curl -fsS http://127.0.0.1:8080/healthz.json > /dev/null || exit 1
+CMD ["node", "dist/server/entry.mjs"]

package/containers/web-ssr/Dockerfile.dockerignore

@@ -0,0 +1,10 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+apps/cms/vendor
+apps/cms/auth.json
+apps/cms/.env*
+apps/cms/web
+docs

package/containers/web-static/Caddyfile

@@ -0,0 +1,40 @@
+# Static production frontend. Cloudflare terminates TLS and caches at the edge;
+# Traefik forwards plain HTTP to port 8080.
+{
+	admin off
+	auto_https off
+	persist_config off
+	servers {
+		trusted_proxies static private_ranges
+	}
+}
+
+:8080 {
+	header X-Content-Type-Options nosniff
+	header Referrer-Policy strict-origin-when-cross-origin
+	@internal path /.container* /.flowpress* /.env* /server/*
+	respond @internal 404
+	root * /srv/site
+	encode zstd gzip
+
+	# Redirects, headers and media proxies generated from the Astro build.
+	import /srv/site/.container/routes.caddy
+
+	header /healthz.json Cache-Control "no-store"
+	header /_astro/* Cache-Control "public, max-age=31536000, immutable"
+	# HTML revalidates in browsers; Cloudflare keeps it at the edge until the
+	# deploy purge (see docs/wiki/deploy/06-cloudflare.md).
+	@html path / *.html */
+	header @html Cache-Control "public, max-age=0, must-revalidate"
+
+	file_server {
+		hide .container .flowpress-baseline.json .flowpress-fingerprint _redirects _headers _routes.json
+	}
+
+	handle_errors 404 {
+		header Cache-Control "no-store"
+		header CDN-Cache-Control "no-store"
+		rewrite * /404.html
+		file_server
+	}
+}