NodeBB

Use this category to share how you run wpfy in the wild. What to post Your server specs (VPS provider, RAM, CPU, region) How many sites you host on one VPS Your PHP versions and any custom Compose tweaks A screenshot of wpfy site list or wpfy debug output (redacted) What you use wpfy for (agency fleet, personal sites, client work) Rules No secrets. Redact every password, token, and .env value. No client domains unless you have permission to share them. Keep it constructive — this is for the community to learn from real deployments. Template **Provider:** Vultr / Hetzner / DigitalOcean / other **Specs:** 2 vCPU, 4 GB RAM, 80 GB disk **Region:** Amsterdam **Sites:** N isolated stacks **PHP:** 8.4 default, one site on 8.2 **Notes:** anything custom worth sharing Looking forward to seeing your setups.

What's deferred and why. wpfy is beta software — some features are intentionally out of v1 and tracked here so the community knows what's coming and can weigh in. Post feature requests in this category. Search first to avoid duplicates; upvote existing requests instead of reposting. Currently deferred (tracked in the project's open questions) These are documented in the repo's memory and decision log. They are not bugs — they are explicit deferrals pending validation or an architecture decision. Disposable-VPS validation The validation harness exists (scripts/vps-release-validation*.sh) but the final disposable-VPS release run is pending. Until it completes, treat wpfy as beta for production. Traefik Docker socket risk reduction Traefik reads the Docker socket for container discovery. A socket-proxy adoption decision is open. See Security. Supply-chain verification depth How deeply upstream WordPress / WP-CLI artifacts are verified before provisioning is an open question. Currently pull-only. Non-root / read-only filesystem compatibility PHP-FPM images currently run as root (USER www-data deferred — needs a volume-ownership strategy). Explicit non-root and read-only-filesystem compatibility is pending. External scanner runs testssl.sh and nuclei have not been run against a live wpfy host. Hardening probes (Nginx, security headers, ACME, reboot persistence) passed on the last validation VPS. How to request a feature Search this category first. If no match, start a new topic with: The problem you're trying to solve (not just the solution) The wpfy command or workflow you wish existed Whether you'd be willing to test a PR Upvote requests you want with a reply or reaction. What belongs here vs. elsewhere Bug (something broken) → Operations & Troubleshooting, with wpfy debug output. How do I… → the relevant category (Site Management, Stack, etc.). I wish wpfy could… → here. The maintainer triages requests against the roadmap and the decision log. Not every request becomes v1.

Frequently asked questions about Traefik, the shared edge proxy. See also Stack & Infrastructure and Architecture. What is Traefik's role? Traefik is the only shared component across sites. It sits at the edge as a reverse proxy, terminates SSL via Let's Encrypt, and routes traffic to each site's Nginx container. Every site attaches its own network to Traefik — Traefik never gets broad write access to site data. Why one Traefik, not one per site? A single shared Traefik lets all sites share automatic SSL, HTTP→HTTPS redirects, and a unified routing config without each site needing its own edge proxy. Site isolation is preserved because Traefik only proxies — it doesn't read or write site files or databases. The Docker socket risk Traefik reads the Docker socket to discover site containers dynamically. This is a known residual risk: a Traefik compromise could affect container discovery. Mitigations and the open question of socket-proxy adoption are tracked in the project's security docs. See Security. How do I check Traefik is running? wpfy stack status wpfy debug wpfy debug audits Traefik alongside Docker and every site. Traefik won't start / 502 errors wpfy debug — look for Traefik-specific checks. Check the proxy Docker network exists: docker network ls | grep proxy. Check Traefik logs: docker logs traefik --tail 50. Confirm ports 80/443 are free on the host (no other web server bound). Can I replace Traefik with Caddy/Nginx? Not without an ADR. wpfy's architecture is Traefik-first. The edge proxy is part of the documented design; swapping it is an architecture change that requires updating docs/DECISION-LOG.md and the relevant ADR. See Architecture.

How to use wpfy debug and what to include when asking for help. See Operations. What wpfy debug does wpfy debug runs structured checks across: Docker Engine and Compose plugin The Traefik edge proxy Every managed site (runtime, scaffold, HTTP readiness) Certificate state where relevant It returns structured facts — not raw command dumps — so the output is safe to share once secrets are redacted. Run it wpfy debug For a specific site: wpfy site status example.com wpfy site info example.com What to post when asking for help The exact command you ran. What you expected vs. what happened. The wpfy debug output, redacted:$ wpfy debug [ paste here, replace any password/token/key with <redacted> ] OS and Docker version:$ docker --version $ lsb_release -a A redacted .env if the issue is site-specific. See How to ask a good wpfy support question for the full template. Other useful commands wpfy info — aggregate host + site operational facts wpfy log example.com — per-site log inspection wpfy secure — security audit baseline wpfy maintenance — maintenance mode controls Common fixes Site not reachable: wpfy debug → check Traefik + site runtime checks → wpfy site status example.com. SSL failed: DNS/IP preflight — see the SSL FAQ. Restore failed: the archive must validate before the runtime stops. wpfy debug after a failed restore to confirm state. Never paste Database passwords (MariaDB, Redis) API tokens Anything from .env (redact the whole file) SSH private keys ACME account keys

Frequently asked questions about SSL and the DNS/IP preflight. Post new questions in this category. Why does wpfy site ssl fail with "DNS does not match public IP"? wpfy refuses to request a Let's Encrypt certificate unless the domain's DNS A (and AAAA) records resolve to your server's public IP. This prevents failed ACME challenges and accidental certificate issuance for a domain you don't control. Fix: Check DNS: dig +short example.com Check your public IP: curl -s ifconfig.me They must match. Update DNS at your registrar and wait for propagation. What does the preflight actually check? preflight_ssl() compares the domain's resolved A/AAAA records against the server's detected public IPs. Only when they match does wpfy proceed to ACME issuance. See SSL Flow. Can I test SSL without real DNS? Yes, offline: WPFY_TEST_DNS_IPS=1.2.3.4 WPFY_TEST_PUBLIC_IPS=1.2.3.4 wpfy site ssl example.com -le This fakes a DNS/IP match so the preflight passes. Do not use this in production — it bypasses the safety check. I enabled SSL. Now my site redirects oddly. Enabling SSL updates WordPress home and siteurl to https://<domain> after the runtime restarts. If redirects fall back to HTTP, run wpfy site status example.com to confirm the runtime restarted, then clear WordPress/object cache. See Site SSL. How do I force HTTPS? Traefik handles the redirect once the SSL router is active. You don't need a separate plugin. If a site was created without -le, enable SSL: wpfy site ssl example.com -le Backups and restore wpfy site backup example.com — timestamped tarball to /var/lib/wpfy/backups/ wpfy site restore example.com <backup>.tar.gz — restore files and database Backups are never world-readable. Never restore one site's secrets into another. See Site Backup and Site Restore.