Merge pull request 're-merge metrics' (#21) from metrics into main

Reviewed-on: #21

.gitignore

@@ -1,6 +0,0 @@
-.DS_Store
-scripts/supervisord.pid
-scripts/supervisord.log
-scripts/metrics/__pycache__
-scripts/CVE_scanner/__pycache__
-scripts/plugins.json

WordPress-Docker/README.md

@@ -0,0 +1,140 @@
+# WordPress Docker Setup
+
+This repository provides a Dockerized environment for running WordPress locally using Docker Compose. It's designed for quick development and testing without complex installations.
+
+## Architecture
+
+- **Apache Server**: Single Apache container with `mod_userdir` enabled
+- **User Data**: Shared volume containing student org home directories
+- **WordPress**: Separate WordPress + MariaDB containers for testing
+- **Structure**: Each org has `/home/<orgname>/public_html/` served at `http://localhost:8080/~<orgname>`
+
+## 🚀 Quick Start
+
+1. **Clone the repository:**
+
+   ```bash
+   git clone https://git.1337.berkeley.edu/Committee/Secure-OCF-Web-Hosting.git
+   cd Secure-OCF-Web-Hosting/WordPress-Docker
+   ```
+
+2. **Install Docker Desktop:**
+   - [macOS](https://docs.docker.com/desktop/setup/install/mac-install/)
+   - [Windows](https://docs.docker.com/desktop/setup/install/windows-install/)
+
+3. **Build and start the containers:**
+
+   ```bash
+   docker-compose up -d
+   ```
+
+   OR
+
+  ```bash
+   docker compose up -d
+   ```
+
+4. **Access WordPress:**
+
+   Open your browser and navigate to:
+
+   ```
+   http://localhost:8081
+   ```
+
+   Follow the on-screen instructions to complete the WordPress setup.
+
+### Access sites:
+- **Student org sites**:
+  - http://localhost:8080/~studentorg1 (Default, no plugins)
+  - http://localhost:8080/~studentorg2 (Legit plugins)
+  - http://localhost:8080/~studentorg3 (BAD BAD plugins)
+- **WordPress**: http://localhost:8081
+
+### Add new student org:
+```bash
+docker exec -it ocf_apache_server bash
+mkdir -p /home/neworg/public_html
+echo "<h1>New Org</h1>" > /home/neworg/public_html/index.html
+chown -R www-data:www-data /home/neworg
+```
+
+### View Apache logs:
+```bash
+docker logs ocf_apache_server
+```
+
+## Virtual machine (isolated testing)
+
+If you plan to experiment with or reverse-engineer malicious plugins, do this work only in an isolated virtual machine (VM). We provide a link to a VMware download here:
+
+https://drive.google.com/drive/folders/1lGABtrC7S9C2OpGTAlL6uG4DqqE-1zuR
+
+Guidance:
+- Use VMware and create a VM running a disposable OS such as Ubuntu or Kali Linux.
+- Perform any development, testing, or analysis of intentionally malicious plugins only inside that VM. Do not deploy or test them on your host machine or any production network.
+- Keep the VM network isolated from your production network when possible and snapshot the VM before risky experiments so you can revert changes.
+
+Only analyze or test malware and malicious plugins in controlled, authorized environments. Do not use these techniques to attack or harm others.
+
+## Volume management
+
+> [!WARNING] Contact JQ or another officer if you are editing the default setup and don't understand the following documentation.
+
+There are 3 important mount points. `userdata`, `wp-content`, and `backup.sql` are all files / directories on the host machine that are then mounted on the respective containers.
+
+Currently, backup.sql is mounted to the database container, `userdata` doesn't do anything, and `wp-content` is mounted to the `wordpress` container. They are set up for minimum reproducibility: i.e. there is an admin user with the default page. Credentials are in the `docker-compose.yml` file. If you'd like to make changes to the default, it is imperative that you make a backup of the sql file. You should then copy that `backupX.sql` file to the one in the repo so that the database will update.
+
+```bash
+docker compose exec -it db /bin/bash
+mariadb-dump -u wp_user -p wp_db > backupX.sql # Change X to the number of the userdata volume you're editing.
+# Then enter the password for wp_user, which should be in the docker compose.
+exit
+docker compose cp db:/backupX.sql ./backupX.sql
+```
+
+As a one-liner: 
+```bash
+docker compose exec -it db "mariadb-dump -u wp_user -p wp_db > backupX.sql" # Make sure you change X!
+```
+
+
+The rest should auto-update. If you don't want to make a change to the `wp-content` directory or database, you can them to your `.gitignore`.
+
+## ⚙️ Managing Containers
+
+* **Start containers:**
+
+  ```bash
+  docker-compose start
+  ```
+
+* **Stop containers:**
+
+  ```bash
+  docker-compose stop
+  ```
+
+* **Stop and remove containers:**
+
+  ```bash
+  docker-compose down
+  ```
+
+  Add the `-v` flag to also remove volumes:
+
+  ```bash
+  docker-compose down -v
+  ```
+
+
+
+## 🔐 Accessing phpMyAdmin
+
+If phpMyAdmin is included in your setup:
+
+* Open your browser and navigate to:
+
+  ```
+  http://localhost:8081
+  ```

WordPress-Docker/apache/Dockerfile

@@ -0,0 +1,28 @@
+# Dockerfile (apache-static)
+FROM httpd:2.4
+
+LABEL maintainer="random@gmail.com"
+
+# Enable required Apache modules for user directories and PHP
+RUN sed -i \
+    -e 's/#LoadModule userdir_module/LoadModule userdir_module/' \
+    -e 's/#LoadModule vhost_alias_module/LoadModule vhost_alias_module/' \
+    -e 's/#LoadModule rewrite_module/LoadModule rewrite_module/' \
+    -e 's/#Include conf\/extra\/httpd-userdir.conf/Include conf\/extra\/httpd-userdir.conf/' \
+    /usr/local/apache2/conf/httpd.conf
+
+# Add custom configuration for user directories
+COPY httpd-userdir.conf /usr/local/apache2/conf/extra/httpd-userdir.conf
+
+# Create example student org directories with basic content
+RUN mkdir -p /home/studentorg1/public_html && \
+    echo "<h1>Welcome to Student Org 1's OCF Page</h1><p>This is a test page.</p>" > /home/studentorg1/public_html/index.html && \
+    mkdir -p /home/studentorg2/public_html && \
+    echo "<h1>Welcome to Student Org 2's OCF Page</h1><p>This is a test page.</p>" > /home/studentorg2/public_html/index.html && \
+    mkdir -p /home/studentorg3/public_html && \
+    echo "<h1>Welcome to Student Org 3's OCF Page</h1><p>This is a test page.</p>" > /home/studentorg3/public_html/index.html
+
+# Set proper ownership
+RUN chown -R www-data:www-data /home
+
+EXPOSE 80

WordPress-Docker/apache/httpd-userdir-vhosts.conf

@@ -0,0 +1,24 @@
+# Settings for user home directories
+
+<VirtualHost *:80>
+    UseCanonicalName Off
+
+    # Map subdomains like user.ocf.local to /home/user/public_html
+    VirtualDocumentRoot /home/%1/public_html
+
+    ServerAlias *.ocf.local
+
+    # Mimics OCF structure where user directories are in /home
+    
+    <Directory /home/*/public_html>
+        AllowOverride All
+        Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+        Require all granted
+
+        # Allow .htaccess usage for student customization
+        <IfModule mod_rewrite.c>
+            RewriteEngine On
+        </IfModule>
+    </Directory>
+
+</VirtualHost>

WordPress-Docker/apache/httpd-userdir.conf

@@ -0,0 +1,20 @@
+# Settings for user home directories
+#
+# Required module: mod_userdir
+
+UserDir /home/*/public_html
+
+#
+# Control access to UserDir directories.
+# Mimics OCF structure where user directories are in /home
+#
+<Directory "/home/*/public_html">
+    AllowOverride All
+    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+    Require all granted
+
+    # Allow .htaccess usage for student customization
+    <IfModule mod_rewrite.c>
+        RewriteEngine On
+    </IfModule>
+</Directory>

WordPress-Docker/backup2.sql

@@ -0,0 +1,28 @@
+/*M!999999\- enable the sandbox mode */ 
+-- MariaDB dump 10.19-11.8.3-MariaDB, for debian-linux-gnu (aarch64)
+--
+-- Host: localhost    Database: wp_db
+-- ------------------------------------------------------
+-- Server version	11.8.3-MariaDB-ubu2404
+
+/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
+/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
+/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
+/*!40101 SET NAMES utf8mb4 */;
+/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
+/*!40103 SET TIME_ZONE='+00:00' */;
+/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
+/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
+/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
+/*M!100616 SET @OLD_NOTE_VERBOSITY=@@NOTE_VERBOSITY, NOTE_VERBOSITY=0 */;
+/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
+
+/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
+/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
+/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
+/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
+/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
+/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
+/*M!100616 SET NOTE_VERBOSITY=@OLD_NOTE_VERBOSITY */;
+
+-- Dump completed on 2025-10-22  5:21:45

WordPress-Docker/docker-compose.yml

@@ -0,0 +1,98 @@
+services:
+  # loki:
+  #   image: grafana/loki:3.0.0
+  #   container_name: loki
+  #   ports:
+  #     - "3100:3100"
+  #   command: -config.file=/etc/loki/local-config.yaml
+  #   restart: unless-stopped
+
+  # grafana:
+  #   image: grafana/grafana:10.4.0
+  #   container_name: grafana
+  #   ports:
+  #     - "3000:3000"
+  #   environment:
+  #     - GF_SECURITY_ADMIN_USER=admin
+  #     - GF_SECURITY_ADMIN_PASSWORD=ocfsecure
+  #   depends_on:
+  #     - loki
+  #   restart: unless-stopped
+
+  # alloy:
+  #   image: grafana/alloy:latest
+  #   container_name: alloy
+  #   volumes:
+  #     - ./alloy-config.yml:/etc/alloy/config.alloy
+  #     - ./logs:/var/log/scanner
+  #   ports:
+  #     - "12345:12345"   # optional web UI/debug
+  #   command: run /etc/alloy/config.alloy
+  #   environment:
+  #     - ALLOY_ENABLE_WEB=true
+  #   depends_on:
+  #     - loki
+  #   restart: unless-stopped
+
+  apache:
+    build:
+      context: ./apache
+    ports:
+      - "8080:80"
+    volumes:
+      - userdata1:/home/user1/public_html
+      - userdata2:/home/user2/public_html
+      - userdata3:/home/user3/public_html
+    container_name: apache-static
+    restart: unless-stopped
+
+  db:
+    image: mariadb:11
+    container_name: wp_db
+    environment:
+      MYSQL_ROOT_PASSWORD: rootpass
+      MYSQL_DATABASE: wp_db
+      MYSQL_USER: wp_user
+      MYSQL_PASSWORD: wp_pass
+    volumes:
+      - ./backup2.sql:/docker-entrypoint-initdb.d/backup.sql # CHANGEME to edit different WordPress sites
+    restart: unless-stopped
+
+  wordpress:
+    image: wordpress:latest
+    container_name: wordpress_dev_container
+    depends_on:
+      - db
+    environment:
+      WORDPRESS_DB_HOST: db:3306
+      WORDPRESS_DB_USER: wp_user
+      WORDPRESS_DB_PASSWORD: wp_pass
+      WORDPRESS_DB_NAME: wp_db
+    ports:
+      - "8081:80" # WordPress site -> http://localhost:8081
+    volumes:
+      - userdata2:/var/www/html/wp-content # CHANGEME to edit different WordPress sites
+    restart: unless-stopped
+
+volumes:
+  # Default user:
+  # username: admin
+  # password: GH^*m)qprg7VOZJ(JJ
+  userdata1:
+    driver: local
+    driver_opts:
+      type: none
+      device: ${PWD}/userdata1
+      o: bind
+  userdata2:
+    driver: local
+    driver_opts:
+      type: none
+      device: ${PWD}/userdata2
+      o: bind
+  userdata3:
+    driver: local
+    driver_opts:
+      type: none
+      device: ${PWD}/userdata3
+      o: bind

WordPress-Docker/static-site/index.html

@@ -0,0 +1,19 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Local Apache Static Landing</title>
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <style>
+    body { font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; background:#0f172a; color:#e6eef8; text-align:center; padding-top:8vh; }
+    h1 { color:#10b981; }
+    p { color:#cbd5e1; }
+    a { color:#93c5fd; text-decoration:none; }
+  </style>
+</head>
+<body>
+  <h1>Apache Static Host</h1>
+  <p>This is the static landing page container.</p>
+  <p><a href="http://localhost:8081/wp-admin" target="_blank">Open WordPress setup (wp-admin)</a></p>
+</body>
+</html>