GeezerVison

- any-glob-to-any-file: config/etc/php/**/*

- any-glob-to-any-file: scripts/install/php/**/*

- any-glob-to-any-file: scripts/update/php-*-update.sh

- any-glob-to-any-file: scripts/functions/php-clean.sh

wordpress-plugins:

name: Test Cloudflare API Results

"on":

push:

branches:

- master

paths:

- 'scripts/functions/shared/enginescript-shared-vhost.sh'

- 'scripts/ci/test-cloudflare-api.sh'

- '.github/workflows/test-cloudflare-api.yml'

pull_request:

paths:

- 'scripts/functions/shared/enginescript-shared-vhost.sh'

- 'scripts/ci/test-cloudflare-api.sh'

- '.github/workflows/test-cloudflare-api.yml'

workflow_dispatch:

permissions:

contents: read

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

jobs:

test-cloudflare-api:

runs-on: ubuntu-24.04

timeout-minutes: 5

steps:

- name: Checkout repository

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Run Cloudflare API result tests

run: |

name: Test Configuration Review

"on":

push:

branches:

- master

paths:

- 'config/home/enginescript-install-options.txt'

- 'scripts/functions/shared/enginescript-common.sh'

- 'scripts/install/enginescript-install.sh'

- 'scripts/functions/alias/alias-server-info.sh'

- 'scripts/functions/alias/alias-debug.sh'

- 'scripts/ci/test-config-review.sh'

- '.github/workflows/test-config-review.yml'

pull_request:

paths:

- 'config/home/enginescript-install-options.txt'

- 'scripts/functions/shared/enginescript-common.sh'

- 'scripts/install/enginescript-install.sh'

- 'scripts/functions/alias/alias-server-info.sh'

- 'scripts/functions/alias/alias-debug.sh'

- 'scripts/ci/test-config-review.sh'

- '.github/workflows/test-config-review.yml'

workflow_dispatch:

permissions:

contents: read

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

jobs:

test-config-review:

runs-on: ubuntu-24.04

timeout-minutes: 5

steps:

- name: Checkout repository

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Run configuration review tests

run: |

name: Test Debug Pause

"on":

push:

branches:

- master

paths:

- 'scripts/functions/shared/enginescript-common.sh'

- 'scripts/ci/test-debug-pause.sh'

- '.github/workflows/test-debug-pause.yml'

pull_request:

paths:

- 'scripts/functions/shared/enginescript-common.sh'

- 'scripts/ci/test-debug-pause.sh'

- '.github/workflows/test-debug-pause.yml'

workflow_dispatch:

permissions:

contents: read

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

jobs:

test-debug-pause:

runs-on: ubuntu-24.04

timeout-minutes: 5

steps:

- name: Checkout repository

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Run debug pause tests

run: |

Changes are organized by date, with the most recent changes listed first.

- The debug mode prompt now shows on screen. In every step run from another script (each step of the Nginx, PHP, MariaDB, tools, and control panel installs, and of the updates) it went to the error log instead, so the install waited for Enter with no prompt and looked stuck.

- Typing `exit` at a debug prompt now stops the whole install or update. In a step run from another script it stopped only that script, and the install went on.

- The debug prompt now reads the keyboard, not the script's input, and does not pause when there is no terminal, as in cron.

- Debug mode no longer builds OpenSSL's test programs in the Nginx compile. Nothing ran them, and they made the compile slower.

- Fixed the WP-CLI step failing on new servers. It pinned the `wp-cli/doctor-command` package to 2.3.1, which does not work with the WP-CLI nightly (3.0) that EngineScript installs, and a package that failed stopped the step. Both WP-CLI packages now use `@stable`, the newest release that works with the installed WP-CLI, and a package that cannot be installed or updated is reported without stopping the install or the daily update. The daily update moves servers still pinned to doctor-command 2.3.1 to `@stable`.

- The WP-CLI download is checked before it replaces `/usr/local/bin/wp`, so a failed download no longer leaves a broken `wp` in place.

- `setup.sh` now stops on a server where `es.install` has already completed a step. Running it again deleted and cloned EngineScript, and purged every PHP 8 package, PHP-FPM included. To finish an install, run `es.install`; it continues with the steps not done yet.

- On a virtual machine (any VPS), setup installs the `linux-virtual-hwe-24.04` kernel package instead of `linux-generic-hwe-24.04`. Both install the same kernel and modules; the virtual one leaves out about 1 GB of hardware firmware, the CPU microcode, and the power and USB daemons, which a VM does not use. Physical servers keep the generic package. Existing servers keep the kernel package they have.

- The acme.sh install is tried up to three times when a download fails, and stops with an error instead of going on without acme.sh.

- The AWS CLI install no longer stops to ask about replacing files when it runs again, and updates an existing AWS CLI instead of failing.

- The configuration review at the start of `es.install` now shows every option of the options file. It left out 14 of the 45, among them `HIGH_SECURITY_SSL`, `NGINX_BLOCK_UNSAFE_FILES`, `INSTALL_HTTP3`, `PHP_VERSION_OVERRIDE`, `TEST_MODE`, and `UBUNTU_PRO_TOKEN`, and showed `WORDFENCE_CLI_TOKEN`, which is not an option. `es.info` and `es.debug` now show every setting too (never the credentials).

- The Google Cloud repository key download now fails on an error and uses HTTPS only, and running the step again no longer adds the repository twice.

- The Cloudflare IP updater counted one range too few of each kind (the ranges themselves were all used), and now lists the downloaded ranges only in debug mode.

- The GCC step no longer prints an error on new servers, and the Nginx tuning step shows "not reported" when a virtual CPU reports no L3 cache.

- Setup skips the kernel when it runs in a container, which uses its host's kernel.

- `jq` is now installed with the other dependencies. Several scripts use it, and it was only there because some providers' Ubuntu images include it.

- Fixed the Nginx reload failing ("Job for nginx.service failed") when a new or imported site's certificate was installed. The site's log directory was created after its vhost, and Nginx cannot open a log in a missing directory, so the reload was refused until the services were restarted at the end of the setup.

- The Cloudflare step now prints one line per DNS record and setting, marked ✓, or ✗ with Cloudflare's error message, and a summary, instead of the raw API responses. It warns when Authenticated Origin Pulls could not be turned on, since the site then answers every request with a 400 error.

- WordPress rewrite rules are flushed once, after the permalink structure is set, and without `--hard`, which only tries to write an `.htaccess` file that Nginx does not use. The two warnings this printed during site setup are gone.

- Creating a domain now asks you to confirm it (for example, "Is wordpresstesting.com the correct domain?") before anything is changed. Answering no asks for the domain and TLD again, so a typo no longer goes on to Cloudflare, the certificate, and the database. Importing already showed the site's URL for confirmation or correction.

- Importing a domain that is already installed now stops before the Cloudflare step. The check ran after it, so the import could point the existing site's A record at this server and only then stop.

- Creating a domain that is already installed now stops at the pre-installation check. The check looked for the domain without the quotes `sites.sh` stores it in, so it never found it, and the install went ahead over the existing site.

- The main menu describes `es.update` correctly, and the Domain Configuration, Database, EngineScript, and Backup menus no longer show another menu's title or exit option.

- The cleanup that ran after many install and update steps is one shared function, `run_enginescript_cleanup`. `php-clean.sh` and `enginescript-cleanup.sh` are removed: the first repeated the second's package removal, and every step that ran it ran both.

- Quieter install log: the package removal no longer lists the thousands of packages it checks, phpMyAdmin and the AWS CLI unzip silently, the AWS CLI and Google key downloads no longer show a progress meter in the error log, and WPScan's gems install without building their documentation, which also makes that step faster.

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"

VHOST="${REPO_ROOT}/scripts/functions/shared/enginescript-shared-vhost.sh"

WORK="$(mktemp -d)"

trap 'rm -rf "${WORK}"' EXIT

FAILED=0

pass() { echo "PASS $1"; }

fail() {

echo "FAIL $1"

FAILED=1

}

sed -n '/^ cf_api() {$/,/^ }$/p' "${VHOST}" > "${WORK}/cf-api.sh"

[[ -s "${WORK}/cf-api.sh" ]] || {

echo "FAIL cf_api was not found in enginescript-shared-vhost.sh"

exit 1

}

source "${WORK}/cf-api.sh"

curl() {

printf '%s\n' "$@" > "${WORK}/curl-args"

printf '%s' "${CF_RESPONSE}"

}

ZONE_ID="zone123"

CF_ACCOUNT_EMAIL="[email protected]"

CF_GLOBAL_API_KEY="key"

CF_FAILED=0

run() {

CF_RESPONSE="$1"

set +e

OUTPUT="$(cf_api "$2" PATCH "/settings/ssl" '{"value":"strict"}')"

STATUS=$?

set -e

}

run '{"result":{"id":"ssl","value":"strict"},"success":true,"errors":[],"messages":[]}' "SSL: strict"

if [[ "${STATUS}" -eq 0 && "${OUTPUT}" == " ✓ SSL: strict" ]]; then

pass "a compact success prints one check mark line"

fail "compact success: status ${STATUS}, output '${OUTPUT}'"

run $'{\n "result": {"id": "speed_brain", "value": "on"},\n "success": true,\n "errors": []\n}' "Speed Brain: on"

if [[ "${STATUS}" -eq 0 && "${OUTPUT}" == " ✓ Speed Brain: on" ]]; then

pass "a pretty-printed success prints one check mark line"

fail "pretty-printed success: status ${STATUS}, output '${OUTPUT}'"

run '{"success":false,"errors":[{"code":1015,"message":"This setting is not available on your plan."}],"messages":[],"result":null}' "0-RTT: on"

if [[ "${STATUS}" -eq 1 && "${OUTPUT}" == " ✗ 0-RTT: on: This setting is not available on your plan." ]]; then

pass "a failure prints a cross with Cloudflare's message"

fail "failure: status ${STATUS}, output '${OUTPUT}'"

run '' "IPv6: on"

if [[ "${STATUS}" -eq 1 && "${OUTPUT}" == " ✗ IPv6: on: no answer from Cloudflare" ]]; then

pass "no answer prints a cross"

fail "no answer: status ${STATUS}, output '${OUTPUT}'"

CF_FAILED=0

CF_RESPONSE='{"success":false,"errors":[{"message":"x"}]}'

cf_api "a" PATCH "/settings/a" '{}' > /dev/null || true

cf_api "b" PATCH "/settings/b" '{}' > /dev/null || true

CF_RESPONSE='{"success":true}'

cf_api "c" PATCH "/settings/c" '{}' > /dev/null

if [[ "${CF_FAILED}" -eq 2 ]]; then

pass "failures are counted in CF_FAILED"

fail "CF_FAILED is ${CF_FAILED}, expected 2"

cf_api "d" PATCH "/settings/ipv6" '{"value":"on"}' > /dev/null

if grep -qx 'https://api.cloudflare.com/client/v4/zones/zone123/settings/ipv6' "${WORK}/curl-args" \

&& grep -qx -- '--data' "${WORK}/curl-args" && grep -qx '{"value":"on"}' "${WORK}/curl-args"; then

pass "the call goes to the zone's path with the body"

fail "curl was called with: $(tr '\n' ' ' < "${WORK}/curl-args")"

raw="$(grep -nE 'curl .*-X (PATCH|PUT|POST)' "${VHOST}" | grep -v 'cf_api' || true)"

if [[ -z "${raw}" ]]; then

pass "no Cloudflare change bypasses cf_api"

fail "Cloudflare changes outside cf_api: ${raw}"

exit "${FAILED}"

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"

TEMPLATE="${REPO_ROOT}/config/home/enginescript-install-options.txt"

FAILED=0

pass() { echo "PASS $1"; }

fail() {

echo "FAIL $1"

FAILED=1

}

SUPPORTED_PHP_VERSIONS=(

"8.3"

"8.4"

"8.5"

)

source "${TEMPLATE}"

source "${REPO_ROOT}/scripts/functions/shared/enginescript-common.sh"

mapfile -t OPTIONS < <(sed -n 's/^\([A-Z][A-Z0-9_]*\)=.*/\1/p' "${TEMPLATE}")

[[ "${#OPTIONS[@]}" -gt 0 ]] || {

echo "FAIL no options were found in the template"

exit 1

}

REVIEW="$(print_install_settings 2> /dev/null; print_install_credentials)"

SETTINGS_SOURCE="$(declare -f print_install_settings)"

missing=()

for option in "${OPTIONS[@]}"; do

if ! grep -q "^${option} = " <<< "${REVIEW}" && ! grep -qF "\${${option}" <<< "${SETTINGS_SOURCE}"; then

missing+=("${option}")

fi

if [[ "${#missing[@]}" -eq 0 ]]; then

pass "the review shows all ${#OPTIONS[@]} options of the template"

fail "the review leaves out: ${missing[*]}"

check_list() {

local label="$1"

shift

local -a listed=("$@") in_template=() stale=()

local name option

for name in "${listed[@]}"; do

printf '%s\n' "${OPTIONS[@]}" | grep -qx "${name}" || stale+=("${name}")

done

for option in "${OPTIONS[@]}"; do

printf '%s\n' "${listed[@]}" | grep -qx "${option}" && in_template+=("${option}")

done

if [[ "${#stale[@]}" -gt 0 ]]; then

fail "${label} has names the template lacks: ${stale[*]}"

elif [[ "${listed[*]}" != "${in_template[*]}" ]]; then

fail "${label} is not in the template's order, or lists a name twice"

else

pass "${label}: ${#listed[@]} options, in the template's order"

fi

}

check_list "ENGINESCRIPT_SETTING_NAMES" "${ENGINESCRIPT_SETTING_NAMES[@]}"

check_list "ENGINESCRIPT_CREDENTIAL_NAMES" "${ENGINESCRIPT_CREDENTIAL_NAMES[@]}"

overlap="$(printf '%s\n' "${ENGINESCRIPT_SETTING_NAMES[@]}" "${ENGINESCRIPT_CREDENTIAL_NAMES[@]}" | sort | uniq -d)"

if [[ -z "${overlap}" ]]; then

pass "no option is both a setting and a credential"

fail "in both lists: ${overlap//$'\n'/ }"

INSTALL="${REPO_ROOT}/scripts/install/enginescript-install.sh"

INFO="${REPO_ROOT}/scripts/functions/alias/alias-server-info.sh"

DEBUG="${REPO_ROOT}/scripts/functions/alias/alias-debug.sh"

if grep -q '^print_install_settings$' "${INSTALL}" && grep -q '^print_install_credentials$' "${INSTALL}"; then

pass "es.install shows the settings and the credentials"

fail "es.install does not call print_install_settings and print_install_credentials"

if grep -q '^print_install_settings$' "${INFO}" && ! grep -q 'print_install_credentials\|ENGINESCRIPT_CREDENTIAL_NAMES' "${INFO}"; then

pass "es.info shows the settings and no credentials"

fail "es.info does not show the settings, or shows credentials"

if grep -q 'ENGINESCRIPT_SETTING_NAMES\[@\]' "${DEBUG}" && ! grep -q 'print_install_credentials\|ENGINESCRIPT_CREDENTIAL_NAMES' "${DEBUG}"; then

pass "es.debug shows the settings and no credentials"

fail "es.debug does not show the settings, or shows credentials"

exit "${FAILED}"