🛠️ Runbook

This runbook defines the safe human operating sequence for updating the BLLD static brochure from its private WordPress source.

⚠️ WARNING: Secret Exposure Secret values (like .env contents, database passwords) must never be copied into wiki content, logs, commands, or chat.

Sanctioned Operating Sequence

The only approved workflow for updating the static site is:

1. Inspect source context: Review the current state of /home/loca/dev/blld.loca.zone (public root) and /home/loca/dev/blld.loca.zone-private/wp-docker (private source).
2. Start and verify the compose stack: When editing WordPress is required, start the loopback-only container stack:

   cd /home/loca/dev/blld.loca.zone-private/wp-docker
   docker compose --env-file /home/loca/dev/blld.loca.zone-private/wp-docker/.env up -d

3. Process and export the static mirror: After saving changes in WordPress and exporting the static HTML, run the post-processing tool to normalize the output.

   node /home/loca/dev/blld.loca.zone-private/tools/postprocess-static-mirror.mjs

4. Inspect changed static routes: Verify the processed files in /home/loca/dev/blld.loca.zone correctly reflect your changes.
5. Update wiki facts: If architecture or operations change, update the corresponding SSOT wiki pages.
6. Run the wiki check build: Validate the wiki changes before publishing.

   bash /home/loca/dev/wikis/build.sh blld --check-only

7. Publish the wiki: Only after the check succeeds, build and publish the final wiki content.

   bash /home/loca/dev/wikis/build.sh blld

Verification Checks

Run the following checks to ensure the stack is secure and operating correctly:

1. Secret file permissions Ensure the .env file is protected:

stat -c %a:%n /home/loca/dev/blld.loca.zone-private/wp-docker/.env

(Expect output: 600:/home/loca/dev/blld.loca.zone-private/wp-docker/.env)

2. Loopback binding Verify the WordPress container is only accessible locally:

ss -tlnp | grep 54321

(Expect output showing the port bound to 127.0.0.1:54321)

3. Blocked public endpoints Confirm sensitive and retired paths return a 404 or 403 response:

curl -sk -o /dev/null -w '%{http_code}\n' https://blld.loca.zone/wp-docker/docker-compose.yml
curl -sk -o /dev/null -w '%{http_code}\n' https://blld.loca.zone/tools/postprocess-static-mirror.mjs
curl -sk -o /dev/null -w '%{http_code}\n' https://blld.loca.zone/wp-json/wp/v2/pages/90
curl -sk -o /dev/null -w '%{http_code}\n' 'https://blld.loca.zone/xmlrpc.php?rsd'
curl -sk -o /dev/null -w '%{http_code}\n' https://blld.loca.zone/wp/wp-login.php
curl -sk -o /dev/null -w '%{http_code}\n' https://blld.loca.zone/warenkorb/
curl -sk -o /dev/null -w '%{http_code}\n' https://blld.loca.zone/feed/