fix: harden wordpress edge exposure

2026-06-25 22:57:43 +02:00
parent 02e05ec3b6
commit 82ae9eaae4
11 changed files with 91 additions and 7 deletions
@@ -15,6 +15,8 @@ browser tests.
 - `certbot`: optional HTTP-01 certificate issue/renewal service.
 - `wp-cli`: opt-in bootstrap and maintenance service.
 - `tests/functional`: Playwright tests running only through the public virtual host.
+- `tests/security`: containerized static checks for security-sensitive Compose and
+  Apache assumptions.

 See [architecture](docs/architecture.md) and
 [ADR-0001](docs/adr/0001-wordpress-single-page.md).
@@ -224,6 +226,7 @@ docker compose run --rm --no-deps proxy nginx -t
 docker compose -f docker-compose.yml -f docker-compose.test.yml up --build -d db wordpress proxy
 docker compose -f docker-compose.yml -f docker-compose.test.yml --profile tools run --rm wp-cli /scripts/bootstrap.sh
 docker compose -f docker-compose.yml -f docker-compose.test.yml --profile test run --build --rm functional-tests
+docker compose -f docker-compose.yml -f docker-compose.test.yml --profile test run --rm security-tests
 docker compose config --quiet
 ```