fix: make wordpress healthcheck production safe

wordpress/Dockerfile

@@ -3,11 +3,13 @@ FROM wordpress:7.0.0-php8.3-apache
 COPY php.ini /usr/local/etc/php/conf.d/azionelab.ini
 COPY .htaccess /opt/azionelab/.htaccess
 COPY entrypoint-wrapper.sh /usr/local/bin/azionelab-entrypoint
+COPY healthcheck.php /usr/local/bin/azionelab-healthcheck.php
 COPY theme/azionelab /opt/azionelab/theme
 COPY mu-plugins/azionelab-content.php /opt/azionelab/azionelab-content.php
 
 RUN sed -ri 's!^[[:space:]]*CustomLog .*!CustomLog /dev/null combined!' /etc/apache2/sites-available/000-default.conf \
     && chmod 755 /usr/local/bin/azionelab-entrypoint \
+    && chmod 644 /usr/local/bin/azionelab-healthcheck.php \
     && chown -R www-data:www-data /opt/azionelab
 
 ENTRYPOINT ["azionelab-entrypoint"]

wordpress/healthcheck.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+$wpUrl = getenv('WP_URL') ?: 'http://localhost';
+$parts = parse_url($wpUrl);
+$host = $parts['host'] ?? 'localhost';
+$scheme = $parts['scheme'] ?? 'http';
+$port = isset($parts['port']) ? (int) $parts['port'] : null;
+
+$hostHeader = $host;
+if ($port !== null && !(($scheme === 'http' && $port === 80) || ($scheme === 'https' && $port === 443))) {
+    $hostHeader .= ':' . $port;
+}
+
+$context = stream_context_create([
+    'http' => [
+        'follow_location' => 0,
+        'header' => "Host: {$hostHeader}\r\nX-Forwarded-Proto: {$scheme}\r\n",
+        'ignore_errors' => true,
+        'max_redirects' => 0,
+        'timeout' => 3,
+    ],
+]);
+
+$response = @file_get_contents('http://127.0.0.1/wp-login.php', false, $context);
+if ($response === false || empty($http_response_header[0])) {
+    exit(1);
+}
+
+if (!preg_match('/\s([0-9]{3})\s/', $http_response_header[0], $matches)) {
+    exit(1);
+}
+
+$status = (int) $matches[1];
+exit($status >= 200 && $status < 400 ? 0 : 1);