Merge ~barryprice/charm-k8s-wordpress/+git/wordpress-k8s-image-builder:master into ~wordpress-charmers/charm-k8s-wordpress/+git/wordpress-k8s-image-builder:master

[Barry Price]

First pass at handling site config via env variables

[Barry Price (barryprice)]

Passing run:

https://jenkins.canonical.com/is/job/wordpress-k8s-image-builder/21/console

Still need to confirm the image actually runs as expected...

[Barry Price (barryprice)]

And another, post-fix:

https://jenkins.canonical.com/is/job/wordpress-k8s-image-builder/22/console

[Barry Price (barryprice)]

Confirmed working with a local (juju/microk8s) deploy.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Benjamin Allot (ballot)]

A general comment on the dockerfile.

All metadata related steps, LABEL, ENTRYPOINT, CMD, need to be carefully placed in the Dockerfile to maximize cache usage.

I would move ENTRYPOINT and CMD right under the ARG part, even if it's minor.

As for the RUN however, the rule of thumb is to avoid their number as much as possible.
Doing one big RUN with a seccession of "&&" or say, 2, one for the install of package, one for the configuration items would be preferred IMO.

Also, I would the curl of the latest wordpress tarball at the top of the chain, so if we have a conenctivity issue and this fails, we fail early.

Last, but not least, ubuntu docker image already have a cleaning automated after all apt commands

$ docker run --rm -ti ubuntu:bionic cat /etc/apt/apt.conf.d/docker-clean
DPkg::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };
APT::Update::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };
Dir::Cache::pkgcache ""; Dir::Cache::srcpkgcache "";

[Barry Price (barryprice)]

Build is still working, at least:

https://jenkins.canonical.com/is/job/wordpress-k8s-image-builder/24/console

[Barry Price (barryprice)]

Deploy confirmed working too. Ready for re-review, I think.

[Tom Haddon (mthaddon)]

Two comments inline

[Tom Haddon (mthaddon)]

Based on discussions on IRC I'm approving this. I'd missed the fact we were still doing an autoremove, and it seems there's no functional difference to adding --no-install-recommends, so that must be being set in the docker images's apt preferences already.

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision d926292f1df9ee1c686a69370a4c1bcede7421b6

diff --git a/Dockerfile b/Dockerfile
index d9d9d67..ae922d5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,21 +8,16 @@ ARG BUILD_DATE
 
 LABEL org.label-schema.build-date=$BUILD_DATE
 
+ENV APACHE_CONFDIR=/etc/apache2
+ENV APACHE_ENVVARS=/etc/apache2/envvars
+
 # Avoid interactive prompts
 RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
 
-# Update all packages, remove cruft
+# Update all packages, remove cruft, install required packages, configure apache
 RUN apt-get update && apt-get -y dist-upgrade \
     && apt-get --purge autoremove -y \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-# install and configure apache2 (--no-install-recommends as we don't need ssl-cert)
-ENV APACHE_CONFDIR=/etc/apache2
-ENV APACHE_ENVVARS=/etc/apache2/envvars
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends apache2 \
-    && rm -rf /var/lib/apt/lists/* \
+    && apt-get install -y apache2 php libapache2-mod-php php-mysql php-gd curl ssl-cert pwgen \
     && sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS" \
     && . "$APACHE_ENVVARS" \
     && for dir in "$APACHE_LOCK_DIR" "$APACHE_RUN_DIR" "$APACHE_LOG_DIR"; do rm -rvf "$dir"; mkdir -p "$dir"; chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; chmod 777 "$dir";  done \
@@ -31,17 +26,10 @@ RUN apt-get update \
     && ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log" \
     && chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
 
-# Configure PHP
+# Configure PHP and apache2 - mod_php requires us to use mpm_prefork
 COPY ./files/docker-php.conf $APACHE_CONFDIR/conf-available/docker-php.conf
-RUN a2enconf docker-php
-
-# Install PHP
-RUN apt-get update && apt-get install -y curl php libapache2-mod-php php-mysql php-gd \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-# mod_php requires us to use mpm_prefork
-RUN a2dismod mpm_event \
+RUN a2enconf docker-php \
+    && a2dismod mpm_event \
     && a2enmod mpm_prefork
 
 # Install the main Wordpress code, this will be our only site so /var/www/html is fine
@@ -56,6 +44,16 @@ RUN curl -o wordpress.tar.gz -fSL "https://wordpress.org/latest.tar.gz" \
 COPY --chown=www-data:www-data ./files/plugins/ /var/www/html/wp-content/plugins/
 COPY --chown=www-data:www-data ./files/themes/ /var/www/html/wp-content/themes/
 
+# wp-info.php contains template variables which our ENTRYPOINT script will populate
+COPY ./files/wp-info.php /var/www/html/
+COPY ./files/wp-config.php /var/www/html/
+
+# entrypoint script will configure Wordpress based on env variables
+COPY ./files/docker-entrypoint.sh /usr/local/bin/
+
+RUN chmod 0755 /usr/local/bin/docker-entrypoint.sh
 # Port 80 only, TLS will terminate elsewhere
 EXPOSE 80
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD apachectl -D FOREGROUND
diff --git a/files/docker-entrypoint.sh b/files/docker-entrypoint.sh
new file mode 100644
index 0000000..5f67d9d
--- /dev/null
+++ b/files/docker-entrypoint.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+set -eu
+
+sed -i -e "s/%%%WORDPRESS_DB_HOST%%%/$WORDPRESS_DB_HOST/" /var/www/html/wp-info.php
+sed -i -e "s/%%%WORDPRESS_DB_NAME%%%/$WORDPRESS_DB_NAME/" /var/www/html/wp-info.php
+sed -i -e "s/%%%WORDPRESS_DB_USER%%%/$WORDPRESS_DB_USER/" /var/www/html/wp-info.php
+sed -i -e "s/%%%WORDPRESS_DB_PASSWORD%%%/$WORDPRESS_DB_PASSWORD/" /var/www/html/wp-info.php
+
+for key in AUTH_KEY SECURE_AUTH_KEY LOGGED_IN_KEY NONCE_KEY AUTH_SALT SECURE_AUTH_SALT LOGGED_IN_SALT NONCE_SALT;
+do
+    sed -i -e "s/%%%${key}%%%/$(pwgen 64 1)/" /var/www/html/wp-info.php
+done
+
+exec "$@"
diff --git a/files/wp-config.php b/files/wp-config.php
new file mode 100644
index 0000000..7bcbc13
--- /dev/null
+++ b/files/wp-config.php
@@ -0,0 +1,25 @@
+<?php
+#
+#    "             "
+#  mmm   m   m   mmm   m   m
+#    #   #   #     #   #   #
+#    #   #   #     #   #   #
+#    #   "mm"#     #   "mm"#
+#    #             #
+#  ""            ""
+# This file is managed by Juju. Do not make local changes.
+#
+
+/* That's all, stop editing! Happy blogging. */
+
+/** Absolute path to the WordPress directory. */
+if ( !defined('ABSPATH') )
+        define('ABSPATH', dirname(__FILE__) . '/');
+
+/** Pull in the config information */
+require_once(ABSPATH . 'wp-info.php');
+
+/** Sets up WordPress vars and included files. */
+require_once(ABSPATH . 'wp-settings.php');
+
+remove_filter('template_redirect', 'redirect_canonical');
diff --git a/files/wp-info.php b/files/wp-info.php
new file mode 100644
index 0000000..5a891a2
--- /dev/null
+++ b/files/wp-info.php
@@ -0,0 +1,53 @@
+<?php
+#
+#    "             "
+#  mmm   m   m   mmm   m   m
+#    #   #   #     #   #   #
+#    #   #   #     #   #   #
+#    #   "mm"#     #   "mm"#
+#    #             #
+#  ""            ""
+# This file is managed by Juju. Do not make local changes.
+#
+
+// We have to cheat a little because frontend service can terminate SSL
+// If it does it should set X-Edge-Https header to "on" to tell us original
+// request came on https
+
+if (!empty($_SERVER['HTTP_X_EDGE_HTTPS']) && 'off' != $_SERVER['HTTP_X_EDGE_HTTPS']) {
+        $_SERVER['HTTPS'] = 'on';
+}
+
+if (!empty($_SERVER['HTTPS']) && 'off' != $_SERVER['HTTPS']) {
+    define('WP_PLUGIN_URL', 'https://' . $_SERVER['HTTP_HOST'] . '/wp-content/plugins');
+    define('WP_CONTENT_URL', 'https://' . $_SERVER['HTTP_HOST'] . '/wp-content');
+    define('WP_SITEURL', 'https://' . $_SERVER['HTTP_HOST']);
+    define('WP_URL', 'https://' . $_SERVER['HTTP_HOST']);
+    define('WP_HOME', 'https://' . $_SERVER['HTTP_HOST']);
+}
+else {
+    define('WP_PLUGIN_URL', 'http://' . $_SERVER['HTTP_HOST'] . '/wp-content/plugins');
+    define('WP_CONTENT_URL', 'http://' . $_SERVER['HTTP_HOST'] . '/wp-content');
+    define('WP_SITEURL', 'http://' . $_SERVER['HTTP_HOST']);
+    define('WP_URL', 'http://' . $_SERVER['HTTP_HOST']);
+    define('WP_HOME', 'http://' . $_SERVER['HTTP_HOST']);
+}
+
+define('DB_NAME', '%%%WORDPRESS_DB_NAME%%%');
+define('DB_USER', '%%%WORDPRESS_DB_USER%%%');
+define('DB_HOST', '%%%WORDPRESS_DB_HOST%%%');
+
+define('DB_PASSWORD', '%%%WORDPRESS_DB_PASSWORD%%%');
+
+define('WP_CACHE', true);
+
+define('AUTH_KEY', '%%%AUTH_KEY%%%');
+define('SECURE_AUTH_KEY', '%%%SECURE_AUTH_KEY%%%');
+define('LOGGED_IN_KEY', '%%%LOGGED_IN_KEY%%%');
+define('NONCE_KEY', '%%%NONCE_KEY%%%');
+define('AUTH_SALT', '%%%AUTH_SALT%%%');
+define('SECURE_AUTH_SALT', '%%%SECURE_AUTH_SALT%%%');
+define('LOGGED_IN_SALT', '%%%LOGGED_IN_SALT%%%');
+define('NONCE_SALT', '%%%NONCE_SALT%%%');
+
+$table_prefix  = 'wp_';