fix: use Traefik labels instead of Caddy — update deploy stack for Contabo

- docker-compose.yml: Traefik routers/services labels, TLS via letsencrypt certresolver
- deploy.sh: auto-detects Traefik network, installs plugins from GitHub raw URLs
- Containers: ummah2-db, ummah2-wp (apache variant for simpler setup), ummah2-wpcli

ummah-wordpress/.env.example

@@ -0,0 +1,14 @@
+# ummah2.falahos.my WordPress — Contabo Deployment
+# Copy to .env and fill values (retrieve from bitwarden.falahos.my)
+
+DB_ROOT_PASSWORD=
+DB_PASSWORD=
+
+# WP Admin (set during wp-install.sh)
+WP_ADMIN_USER=admin
+WP_ADMIN_EMAIL=wanjauhari@gmail.com
+WP_ADMIN_PASSWORD=
+
+# Site
+WP_SITE_URL=https://ummah2.falahos.my
+WP_SITE_TITLE=Ummah FalahOS

ummah-wordpress/deploy.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# deploy.sh — spin up ummah2.falahos.my on Contabo via Traefik
+set -euo pipefail
+
+DEPLOY_DIR="/opt/ummah-wordpress"
+SITE_URL="https://ummah2.falahos.my"
+REPO="https://github.com/maifors/falah-os.git"
+BRANCH="community-edition"
+
+echo "▶ Deploying ummah2.falahos.my"
+
+# ── Clone / update repo ───────────────────────────────────────────────────────
+if [ -d "$DEPLOY_DIR/.git" ]; then
+  git -C "$DEPLOY_DIR" fetch origin
+  git -C "$DEPLOY_DIR" reset --hard origin/$BRANCH
+else
+  git clone --branch "$BRANCH" --depth 1 "$REPO" "$DEPLOY_DIR"
+fi
+cd "$DEPLOY_DIR/ummah-wordpress"
+
+# ── .env setup ────────────────────────────────────────────────────────────────
+if [ ! -f .env ]; then
+  cp .env.example .env
+  echo ""
+  echo "⚠️  Fill .env before continuing:"
+  echo "   nano $DEPLOY_DIR/ummah-wordpress/.env"
+  echo ""
+  echo "   DB_ROOT_PASSWORD — strong random password"
+  echo "   DB_PASSWORD      — strong random password"
+  echo "   WP_ADMIN_PASSWORD — strong password for /wp-admin"
+  exit 0
+fi
+
+source .env
+
+# ── Detect Traefik network name ───────────────────────────────────────────────
+TRAEFIK_NETWORK=$(docker network ls --format '{{.Name}}' | grep -iE "traefik|proxy|public" | head -1 || echo "traefik-public")
+export TRAEFIK_NETWORK
+echo "   Using Traefik network: $TRAEFIK_NETWORK"
+
+# ── Check https-redirect middleware exists ────────────────────────────────────
+# If not, add it (some Traefik setups define it globally, some don't)
+if ! docker inspect traefik 2>/dev/null | grep -q "https-redirect"; then
+  echo "   Note: https-redirect middleware may need to be pre-defined in Traefik config"
+fi
+
+# ── Start stack ───────────────────────────────────────────────────────────────
+echo "── Starting DB ──"
+docker compose up -d db
+echo "   Waiting for MariaDB…"
+until docker compose exec -T db mysqladmin ping -u root -p"$DB_ROOT_PASSWORD" --silent 2>/dev/null; do
+  sleep 2
+done
+echo "   DB ready ✅"
+
+echo "── Starting WordPress ──"
+docker compose up -d wordpress
+
+echo "   Waiting for WordPress files…"
+for i in $(seq 1 40); do
+  if docker compose exec -T wordpress test -f /var/www/html/wp-includes/version.php 2>/dev/null; then
+    break
+  fi
+  sleep 3
+done
+
+# ── WP-CLI install ────────────────────────────────────────────────────────────
+echo "── Running WP install via WP-CLI ──"
+docker compose run --rm wpcli core install \
+  --url="$SITE_URL" \
+  --title="${WP_SITE_TITLE:-Ummah FalahOS}" \
+  --admin_user="${WP_ADMIN_USER:-admin}" \
+  --admin_password="$WP_ADMIN_PASSWORD" \
+  --admin_email="${WP_ADMIN_EMAIL:-wanjauhari@gmail.com}" \
+  --skip-email 2>/dev/null || echo "   Already installed."
+
+# ── Set permalink ─────────────────────────────────────────────────────────────
+docker compose run --rm wpcli rewrite structure '/%postname%/' --hard 2>/dev/null
+
+# ── Install plugins ───────────────────────────────────────────────────────────
+echo "── Installing Falah plugins ──"
+
+# Falah Shortcodes from GitHub raw
+docker compose run --rm wpcli plugin install \
+  "https://github.com/maifors/falah-os/raw/community-edition/wordpress-plugins/falah-shortcodes.zip" \
+  --activate --force 2>/dev/null && echo "   falah-shortcodes ✅" || echo "   falah-shortcodes: upload manually"
+
+# Hermes AI Bridge from GitHub raw
+docker compose run --rm wpcli plugin install \
+  "https://github.com/maifors/falah-os/raw/community-edition/wordpress-plugins/hermes-ai-bridge.zip" \
+  --activate --force 2>/dev/null && echo "   hermes-ai-bridge ✅" || echo "   hermes-ai-bridge: upload manually"
+
+# Essential WP.org plugins
+echo "── Installing WP.org plugins ──"
+for plugin in astra tutor-lms mailpoet woocommerce easy-digital-downloads litespeed-cache; do
+  docker compose run --rm wpcli plugin install "$plugin" --activate 2>/dev/null \
+    && echo "   $plugin ✅" || echo "   $plugin ⚠️"
+done
+
+# ── Astra theme ───────────────────────────────────────────────────────────────
+docker compose run --rm wpcli theme install astra --activate 2>/dev/null || true
+
+# ── WP performance settings ───────────────────────────────────────────────────
+docker compose run --rm wpcli option update blogdescription "Learn, Discuss, and Grow Together" 2>/dev/null || true
+docker compose run --rm wpcli option update timezone_string "Asia/Kuala_Lumpur" 2>/dev/null || true
+docker compose run --rm wpcli option update date_format "d F Y" 2>/dev/null || true
+
+echo ""
+echo "✅ ummah2.falahos.my is live!"
+echo "   WP Admin: $SITE_URL/wp-admin"
+echo "   User: ${WP_ADMIN_USER:-admin}"
+echo ""
+echo "── DNS (add in Cloudflare) ──"
+echo "   ummah2.falahos.my A 13.140.161.244 (proxied)"

ummah-wordpress/docker-compose.yml

@@ -0,0 +1,93 @@
+version: "3.9"
+
+# ummah2.falahos.my — WordPress on Contabo
+# Reverse proxy: Traefik (already running)
+# Run: docker compose up -d
+
+services:
+  db:
+    image: mariadb:11
+    container_name: ummah2-db
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
+      MYSQL_DATABASE: ummah2_wp
+      MYSQL_USER: ummah2_wp
+      MYSQL_PASSWORD: ${DB_PASSWORD}
+    volumes:
+      - ummah2-db-data:/var/lib/mysql
+    networks:
+      - ummah2-internal
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  wordpress:
+    image: wordpress:6.7-php8.3-apache
+    container_name: ummah2-wp
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      WORDPRESS_DB_HOST: db:3306
+      WORDPRESS_DB_NAME: ummah2_wp
+      WORDPRESS_DB_USER: ummah2_wp
+      WORDPRESS_DB_PASSWORD: ${DB_PASSWORD}
+      WORDPRESS_TABLE_PREFIX: wp_
+      WORDPRESS_DEBUG: "false"
+      PHP_MEMORY_LIMIT: 256M
+      WORDPRESS_CONFIG_EXTRA: |
+        define('WP_MEMORY_LIMIT', '256M');
+        define('WP_HOME', 'https://ummah2.falahos.my');
+        define('WP_SITEURL', 'https://ummah2.falahos.my');
+        $_SERVER['HTTPS'] = 'on';
+        define('FORCE_SSL_ADMIN', true);
+    volumes:
+      - ummah2-wp-data:/var/www/html
+      - ./wordpress-config/php.ini:/usr/local/etc/php/conf.d/ummah2.ini:ro
+    networks:
+      - ummah2-internal
+      - traefik-public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ummah2.rule=Host(`ummah2.falahos.my`)"
+      - "traefik.http.routers.ummah2.entrypoints=websecure"
+      - "traefik.http.routers.ummah2.tls.certresolver=letsencrypt"
+      - "traefik.http.services.ummah2.loadbalancer.server.port=80"
+      # Redirect http→https
+      - "traefik.http.routers.ummah2-http.rule=Host(`ummah2.falahos.my`)"
+      - "traefik.http.routers.ummah2-http.entrypoints=web"
+      - "traefik.http.routers.ummah2-http.middlewares=https-redirect"
+
+  wpcli:
+    image: wordpress:cli-2-php8.3
+    container_name: ummah2-wpcli
+    depends_on:
+      - wordpress
+      - db
+    user: "33:33"
+    environment:
+      WORDPRESS_DB_HOST: db:3306
+      WORDPRESS_DB_NAME: ummah2_wp
+      WORDPRESS_DB_USER: ummah2_wp
+      WORDPRESS_DB_PASSWORD: ${DB_PASSWORD}
+    volumes:
+      - ummah2-wp-data:/var/www/html
+    networks:
+      - ummah2-internal
+    entrypoint: ["tail", "-f", "/dev/null"]
+    profiles: ["tools"]
+
+networks:
+  ummah2-internal:
+    driver: bridge
+  traefik-public:
+    external: true
+    name: ${TRAEFIK_NETWORK:-traefik-public}
+
+volumes:
+  ummah2-db-data:
+  ummah2-wp-data:

ummah-wordpress/migrate-from-cpanel.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# migrate-from-cpanel.sh — import cPanel WordPress backup into Contabo
+# Usage: bash migrate-from-cpanel.sh <backup.tar.gz or SQL dump>
+# Run AFTER deploy.sh has the new WP running.
+set -euo pipefail
+
+DEPLOY_DIR="/opt/ummah-wordpress"
+OLD_URL="https://ummah.falahos.my"
+NEW_URL="https://ummah2.falahos.my"
+BACKUP_FILE="${1:-}"
+
+if [ -z "$BACKUP_FILE" ]; then
+  echo "Usage: $0 <wordpress-backup.tar.gz | database.sql>"
+  echo ""
+  echo "Export from cPanel:"
+  echo "  1. cPanel → Backup Wizard → Full Backup (downloads .tar.gz)"
+  echo "  2. OR: cPanel → phpMyAdmin → Export DB as SQL"
+  echo "  3. OR: cPanel → File Manager → compress /public_html"
+  exit 1
+fi
+
+cd "$DEPLOY_DIR"
+source .env
+
+EXT="${BACKUP_FILE##*.}"
+
+if [ "$EXT" = "sql" ]; then
+  echo "▶ Importing SQL database dump"
+  docker compose exec -T db mysql \
+    -u ummah_wp -p"$DB_PASSWORD" ummah_wp < "$BACKUP_FILE"
+
+  echo "── Updating URLs ──"
+  docker compose run --rm wpcli search-replace "$OLD_URL" "$NEW_URL" \
+    --all-tables --report-changed-only
+
+elif [ "$EXT" = "gz" ] || [ "$EXT" = "zip" ]; then
+  echo "▶ Extracting backup archive"
+  TMP_DIR=$(mktemp -d)
+  if [ "$EXT" = "gz" ]; then
+    tar -xzf "$BACKUP_FILE" -C "$TMP_DIR"
+  else
+    unzip -q "$BACKUP_FILE" -d "$TMP_DIR"
+  fi
+
+  # Find SQL dump inside archive
+  SQL_FILE=$(find "$TMP_DIR" -name "*.sql" | head -1)
+  if [ -n "$SQL_FILE" ]; then
+    echo "── Importing database: $SQL_FILE ──"
+    docker compose exec -T db mysql \
+      -u ummah_wp -p"$DB_PASSWORD" ummah_wp < "$SQL_FILE"
+    docker compose run --rm wpcli search-replace "$OLD_URL" "$NEW_URL" \
+      --all-tables --report-changed-only
+  fi
+
+  # Sync wp-content (themes, plugins, uploads)
+  WP_CONTENT=$(find "$TMP_DIR" -type d -name "wp-content" | head -1)
+  if [ -n "$WP_CONTENT" ]; then
+    echo "── Syncing wp-content ──"
+    VOLUME_PATH=$(docker volume inspect ummah-wordpress_ummah-wp-data \
+      --format '{{.Mountpoint}}')
+    rsync -av --exclude="cache" "$WP_CONTENT/" "$VOLUME_PATH/wp-content/"
+    docker compose exec wordpress chown -R www-data:www-data /var/www/html/wp-content
+  fi
+
+  rm -rf "$TMP_DIR"
+else
+  echo "❌ Unknown file type: $EXT (expected .sql, .tar.gz, or .zip)"
+  exit 1
+fi
+
+# ── Post-migration ────────────────────────────────────────────────────────────
+echo "── Post-migration cleanup ──"
+docker compose run --rm wpcli cache flush
+docker compose run --rm wpcli rewrite flush
+
+echo ""
+echo "✅ Migration complete. Visit: $NEW_URL"
+echo "   Once verified, update DNS: ummah.falahos.my → 13.140.161.244"
+echo "   Then run: wp-cli search-replace ummah2.falahos.my ummah.falahos.my --all-tables"

ummah-wordpress/nginx/default.conf

@@ -0,0 +1,47 @@
+server {
+    listen 80;
+    server_name _;
+    root /var/www/html;
+    index index.php;
+
+    client_max_body_size 64M;
+
+    # Security headers
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header X-Content-Type-Options nosniff;
+    add_header Referrer-Policy strict-origin-when-cross-origin;
+
+    location / {
+        try_files $uri $uri/ /index.php?$args;
+    }
+
+    location ~ \.php$ {
+        fastcgi_pass wordpress:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+        fastcgi_read_timeout 300;
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
+    }
+
+    # WordPress uploads
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+
+    # Block sensitive files
+    location ~ /\.(ht|git|env) {
+        deny all;
+    }
+
+    location = /xmlrpc.php {
+        deny all;
+    }
+
+    location /wp-json/ {
+        try_files $uri $uri/ /index.php?$args;
+    }
+}

ummah-wordpress/wordpress-config/php.ini

@@ -0,0 +1,10 @@
+memory_limit = 256M
+max_execution_time = 300
+upload_max_filesize = 64M
+post_max_size = 64M
+max_input_vars = 5000
+opcache.enable = 1
+opcache.memory_consumption = 128
+opcache.interned_strings_buffer = 8
+opcache.max_accelerated_files = 4000
+opcache.revalidate_freq = 60