This repository provides a Dockerized environment for running WordPress locally using Docker Compose. It's designed for quick development and testing without complex installations.

Architecture

Apache Server: Single Apache container with mod_userdir enabled
User Data: Shared volume containing student org home directories
WordPress: Separate WordPress + MariaDB containers for testing
Structure: Each org has /home/<orgname>/public_html/ served at http://localhost:8080/~<orgname>

🚀 Quick Start

Clone the repository:

git clone https://git.1337.berkeley.edu/Committee/Secure-OCF-Web-Hosting.git
cd Secure-OCF-Web-Hosting/WordPress-Docker

Install Docker Desktop:
- macOS
- Windows
Build and start the containers:
```
docker-compose up -d
```
OR

 docker compose up -d

Access WordPress:

Open your browser and navigate to:
```
http://localhost:8081
```
Follow the on-screen instructions to complete the WordPress setup.

Access sites:

Student org sites:
- http://localhost:8080/~studentorg1 (Default, no plugins)
- http://localhost:8080/~studentorg2 (Legit plugins)
- http://localhost:8080/~studentorg3 (BAD BAD plugins)
WordPress: http://localhost:8081

Add new student org:

docker exec -it ocf_apache_server bash
mkdir -p /home/neworg/public_html
echo "<h1>New Org</h1>" > /home/neworg/public_html/index.html
chown -R www-data:www-data /home/neworg

View Apache logs:

docker logs ocf_apache_server

Virtual machine (isolated testing)

If you plan to experiment with or reverse-engineer malicious plugins, do this work only in an isolated virtual machine (VM). We provide a link to a VMware download here:

https://drive.google.com/drive/folders/1lGABtrC7S9C2OpGTAlL6uG4DqqE-1zuR

Guidance:

Use VMware and create a VM running a disposable OS such as Ubuntu or Kali Linux.
Perform any development, testing, or analysis of intentionally malicious plugins only inside that VM. Do not deploy or test them on your host machine or any production network.
Keep the VM network isolated from your production network when possible and snapshot the VM before risky experiments so you can revert changes.

Only analyze or test malware and malicious plugins in controlled, authorized environments. Do not use these techniques to attack or harm others.

Volume management

[!WARNING] Contact JQ or another officer if you are editing the default setup and don't understand the following documentation.

There are 3 important mount points. userdata, wp-content, and backup.sql are all files / directories on the host machine that are then mounted on the respective containers.

Currently, backup.sql is mounted to the database container, userdata doesn't do anything, and wp-content is mounted to the wordpress container. They are set up for minimum reproducibility: i.e. there is an admin user with the default page. Credentials are in the docker-compose.yml file. If you'd like to make changes to the default, it is imperative that you make a backup of the sql file. You should then copy that backupX.sql file to the one in the repo so that the database will update.

docker compose exec -it db /bin/bash
mariadb-dump -u wp_user -p wp_db > backupX.sql # Change X to the number of the userdata volume you're editing.
# Then enter the password for wp_user, which should be in the docker compose.
exit
docker compose cp db:/backupX.sql ./backupX.sql

As a one-liner:

docker compose exec -it db "mariadb-dump -u wp_user -p wp_db > backupX.sql" # Make sure you change X!

The rest should auto-update. If you don't want to make a change to the wp-content directory or database, you can them to your .gitignore.

⚙️ Managing Containers

Start containers:
```
docker-compose start
```
Stop containers:
```
docker-compose stop
```
Stop and remove containers:
```
docker-compose down
```
Add the -v flag to also remove volumes:
```
docker-compose down -v
```

🔐 Accessing phpMyAdmin

If phpMyAdmin is included in your setup:

Open your browser and navigate to:
```
http://localhost:8081
```