Generate WordPress compose from the site list during provision.

Each host mounts wp-content and gets a compose file from inventory instead of a hand-copied one. Also allow LAN TCP 8020 so abc_voice is reachable through UFW.

inventory/group_vars/all.yml

@@ -14,9 +14,13 @@ ufw_allowed_tcp_ports:
 
 # LiveKit on webservers. Signaling stays LAN (NPM → :7880). UDP must be
 # reachable from the internet via router DNAT to the NPM upstream host.
+# 8020 is abc_voice. That process uses host networking, so Docker does not
+# publish the port and UFW drops it unless it is listed here. NPM
+# (abc.voice.aimloperations.com) reaches it from the LAN.
 ufw_lan_tcp_ports:
   - 7880
   - 7881
+  - 8020
 ufw_extra_udp_ports:
   - 3478
   - "50000:60000"

inventory/wordpress_sites.yml

@@ -0,0 +1,32 @@
+---
+# WordPress sites on every webserver. scripts/provision.sh mounts wp-content
+# and writes one compose file per entry. Do not hand-edit /etc/fstab or the
+# generated compose file on the hosts.
+#
+# name:   site key. Prod is the short name (relawfirm). Beta is that name
+#         plus _beta (relawfirm_beta). Names use lowercase, numbers, underscore.
+# export: dataset path on the TrueNAS NFS server
+# mount:  local path compose bind-mounts to /var/www/html/wp-content
+# port:   host port published to container port 80
+# url:    public https URL (WP_HOME and WP_SITEURL). Empty skips compose.
+#
+# From name, provision derives:
+#   relawfirm      -> /opt/apps/wordpress/relawfirm/docker-compose.yml
+#                     project relawfirm_prod, env /opt/apps/env/relawfirm_prod.env
+#   relawfirm_beta -> /opt/apps/wordpress/relawfirm-beta/docker-compose.yml
+#                     project relawfirm_beta, env /opt/apps/env/relawfirm_beta.env
+
+wordpress_nfs_server: 10.0.0.230
+wordpress_nfs_opts: "nfsvers=4,tcp,_netdev"
+
+wordpress_sites:
+  - name: relawfirm
+    port: 8021
+    url: ""
+    export: /mnt/AIMLOperationsNAS/wordpress/relawfirm
+    mount: /mnt/wordpress/relawfirm/wp-content
+  - name: relawfirm_beta
+    port: 8022
+    url: ""
+    export: /mnt/AIMLOperationsNAS/wordpress/relawfirm_beta
+    mount: /mnt/wordpress/relawfirm_beta/wp-content