Generate WordPress compose from the site list during provision.

Each host mounts wp-content and gets a compose file from inventory instead of a hand-copied one. Also allow LAN TCP 8020 so abc_voice is reachable through UFW.

roles/wordpress/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+wordpress_image: "wordpress:6-apache"
+wordpress_root: "{{ apps_base_dir }}/wordpress"

roles/wordpress/tasks/main.yml

@@ -0,0 +1,77 @@
+---
+# Mount each site's shared wp-content and write its compose file.
+# List lives in inventory/wordpress_sites.yml. Containers are not started
+# here: the first browser install must run on one host only.
+
+- name: Load WordPress site list
+  ansible.builtin.include_vars:
+    file: "{{ inventory_dir }}/wordpress_sites.yml"
+
+- name: Install NFS client
+  ansible.builtin.apt:
+    name: nfs-common
+    state: present
+
+- name: Create WordPress mount points
+  ansible.builtin.file:
+    path: "{{ item.mount }}"
+    state: directory
+    mode: "0755"
+  loop: "{{ wordpress_sites }}"
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Mount WordPress wp-content
+  ansible.posix.mount:
+    src: "{{ wordpress_nfs_server }}:{{ item.export }}"
+    path: "{{ item.mount }}"
+    fstype: nfs
+    opts: "{{ wordpress_nfs_opts }}"
+    dump: "0"
+    passno: "0"
+    state: mounted
+  loop: "{{ wordpress_sites }}"
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Ensure WordPress env directory
+  ansible.builtin.file:
+    path: "{{ apps_env_dir }}"
+    state: directory
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0700"
+
+- name: Ensure WordPress compose directories
+  ansible.builtin.file:
+    path: "{{ wordpress_root }}/{{ item.name | regex_replace('_beta$', '-beta') }}"
+    state: directory
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0755"
+  loop: "{{ wordpress_sites }}"
+  when: (item.url | default('') | length) > 0
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Note WordPress sites waiting on a public URL
+  ansible.builtin.debug:
+    msg: >-
+      WordPress {{ item.name }} has no url. NFS is mounted.
+      Compose is not written until url is set in inventory/wordpress_sites.yml.
+  loop: "{{ wordpress_sites }}"
+  when: (item.url | default('') | length) == 0
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Write WordPress compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ wordpress_root }}/{{ item.name | regex_replace('_beta$', '-beta') }}/docker-compose.yml"
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0644"
+  loop: "{{ wordpress_sites }}"
+  when: (item.url | default('') | length) > 0
+  loop_control:
+    label: "{{ item.name }}"

roles/wordpress/templates/docker-compose.yml.j2

@@ -0,0 +1,21 @@
+# Managed by Ansible (roles/wordpress). Do not edit by hand.
+name: {{ item.name if (item.name is match('.*_beta$')) else (item.name ~ '_prod') }}
+services:
+  wordpress:
+    image: {{ item.image | default(wordpress_image) }}
+    restart: unless-stopped
+    env_file:
+      - {{ apps_env_dir }}/{{ item.name if (item.name is match('.*_beta$')) else (item.name ~ '_prod') }}.env
+    ports:
+      - "{{ item.port }}:80"
+    environment:
+      WORDPRESS_CONFIG_EXTRA: |
+        define('WP_HOME', '{{ item.url }}');
+        define('WP_SITEURL', '{{ item.url }}');
+        define('DISABLE_WP_CRON', true);
+        if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) {
+            $_SERVER['HTTPS'] = 'on';
+        }
+        define('FORCE_SSL_ADMIN', true);
+    volumes:
+      - {{ item.mount }}:/var/www/html/wp-content