Conversation
Adds a self-hosted WordPress site for 138cubpack.com with MariaDB, security hardening, and fail2ban integration. MariaDB: enables services.mysql with conservative memory settings (64MB InnoDB buffer pool, 25 max connections) appropriate for a low-traffic site on a shared VPS. Daily mysqlBackup job matches the existing PostgreSQL backup schedule; backup paths are appended to the existing restic job. WordPress: services.wordpress with webserver=nginx, Unix socket auth to MariaDB (no password), ondemand PHP-FPM pool capped at 4 workers, and three Nix-managed plugins (wp-fail2ban, disable-xml-rpc, simple-login-captcha). FORCE_SSL_ADMIN is set via settings and $_SERVER['HTTPS'] is forced on via extraConfig so nginx SSL termination is handled correctly. DISALLOW_FILE_EDIT is set by the module automatically (read-only Nix store) so we don't duplicate it. Nginx: primary vhost for 138cubpack.com (ACME via Gandi DNS challenge — cert issues after domain transfer) and a dev vhost at 138cubpack.technicalissues.us (cert issues immediately). The dev vhost mirrors root, extraConfig (index index.php), and locations from the primary vhost so they stay in sync. xmlrpc.php is blocked at the nginx layer on both vhosts as defense in depth. Security: wp-fail2ban filter files are symlinked from the plugin's store path into /etc/fail2ban/filter.d/. Two jails watch the systemd journal for WordPress syslog events: wordpress-hard (1 failure = 24h ban) and wordpress-soft (5 failures in 1h = 1h ban). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The NixOS wordpress module copies plugins into the Nix store (read-only), so WP Admin cannot install plugins directly — FS_METHOD=direct would not help. Package wordpress-importer 0.9.6 manually using the fetchzip pattern from the NixOS wiki so it appears in WP Admin → Plugins after a rebuild. Remove this plugin and its derivation from the let block once the WXR import from wordpress.com is complete. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Set upload_max_filesize and post_max_size to 50M in the PHP-FPM pool and client_max_body_size 50M in nginx (dev vhost inherits it via the config reference). Add webp-converter-for-media plugin so uploaded images are automatically converted and served as WebP. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Package the Infield theme (GPL v2, by Automattic) from the Automattic/themes GitHub repo. Not yet in nixpkgs so packaged manually, same pattern as the wordpress-importer plugin. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
services.wordpresson hetznix01 for Cub Scout Pack 138 (138cubpack.com)mysqlBackup(mirrors existing PostgreSQL backup pattern)138cubpack.com(primary) and138cubpack.technicalissues.us(dev, usable before domain transfer)root,extraConfig, andlocationsto stay in sync automaticallywp-fail2banplugin's own filter files viaenvironment.etcsymlinksdisable-xml-rpc,wp-fail2ban,simple-login-captcha,wordpress-importerwordpress-importerpackaged manually (not yet in nixpkgs) for one-time WXR migration from wordpress.com; remove after import is completeMigration steps (after merging / deploying)
wordpress-importerin WP Admin → Plugins138cubpack.comdomain from WordPress.com to Gandihttps://138cubpack.comwordpress-importerderivation and plugin entry, redeploy🤖 Generated with Claude Code