docker compose version
ls /etc/nginx/snippets/ /etc/nginx/conf.d/
free -h
sudo ss -tlpn | grep -E ':(8082|3306) '

sudo tee /etc/nginx/sites-available/blog.TU_DOMINIO > /dev/null <<'EOF'
server {
    listen 80;
    listen [::]:80;
    server_name blog.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}
EOF
sudo ln -s /etc/nginx/sites-available/blog.TU_DOMINIO /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo certbot certonly --webroot -w /var/www/letsencrypt -d blog.TU_DOMINIO --dry-run
sudo certbot certonly --webroot -w /var/www/letsencrypt -d blog.TU_DOMINIO --cert-name blog.TU_DOMINIO

mkdir -p /opt/apps/wordpress/datos /opt/apps/wordpress/php
cd /opt/apps/wordpress
umask 077
cat > .env <<EOF
CLAVE_DB=$(openssl rand -hex 24)
CLAVE_ROOT_DB=$(openssl rand -hex 24)
EOF
umask 022
ls -la

tee /opt/apps/wordpress/php/subidas.ini > /dev/null <<'EOF'
upload_max_filesize = 64M
post_max_size = 64M
memory_limit = 256M
max_execution_time = 120
EOF

cd /opt/apps/wordpress
docker compose pull
docker compose up -d
docker compose ps

curl -I http://127.0.0.1:8082
ls datos/html | head
sudo ls -ld datos/db datos/html

sudo tee /etc/nginx/sites-available/blog.TU_DOMINIO > /dev/null <<'EOF'
# HTTP: Let's Encrypt y redirección a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name blog.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS: reenvío a WordPress (contenedor en 127.0.0.1:8082)
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name blog.TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/blog.TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/blog.TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;

    add_header Strict-Transport-Security "max-age=86400" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    client_max_body_size 64m;

    location / {
        proxy_pass http://127.0.0.1:8082;
        include snippets/proxy.conf;
    }

    access_log /var/log/nginx/blog.access.log;
    error_log  /var/log/nginx/blog.error.log;
}
EOF
sudo nginx -t && sudo systemctl reload nginx

sudo tee /etc/nginx/conf.d/wordpress-limites.conf > /dev/null <<'EOF'
# Límite de intentos en el formulario de acceso de WordPress
limit_req_zone $binary_remote_addr zone=wplogin:10m rate=10r/m;
limit_req_status 429;
EOF

sudo tee /etc/nginx/sites-available/blog.TU_DOMINIO > /dev/null <<'EOF'
# HTTP: Let's Encrypt y redirección a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name blog.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS: reenvío a WordPress (contenedor en 127.0.0.1:8082)
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name blog.TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/blog.TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/blog.TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;

    add_header Strict-Transport-Security "max-age=86400" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    client_max_body_size 64m;

    # Protecciones para WordPress
    location = /xmlrpc.php {
        deny all;
    }
    location ~* ^/wp-content/uploads/.*\.php$ {
        deny all;
    }
    location ~ /\.(?!well-known) {
        deny all;
    }
    location = /wp-login.php {
        limit_req zone=wplogin burst=5 nodelay;
        proxy_pass http://127.0.0.1:8082;
        include snippets/proxy.conf;
    }

    location / {
        proxy_pass http://127.0.0.1:8082;
        include snippets/proxy.conf;
    }

    access_log /var/log/nginx/blog.access.log;
    error_log  /var/log/nginx/blog.error.log;
}
EOF
sudo nginx -t && sudo systemctl reload nginx

sudo tee /etc/fail2ban/filter.d/wordpress-login.conf > /dev/null <<'EOF'
[Definition]
failregex = ^<HOST> \S+ \S+ \[[^\]]+\] "POST /wp-login\.php HTTP/[0-9.]+" 200
ignoreregex =
EOF

sudo tee /etc/fail2ban/jail.d/wordpress.conf > /dev/null <<'EOF'
[wordpress-login]
enabled  = true
port     = http,https
filter   = wordpress-login
logpath  = /var/log/nginx/blog.access.log
backend  = auto
maxretry = 5
findtime = 10m
EOF

sudo fail2ban-regex /var/log/nginx/blog.access.log /etc/fail2ban/filter.d/wordpress-login.conf | grep -E "^Lines|matched"
sudo systemctl restart fail2ban
sudo fail2ban-client status wordpress-login

cd /opt/apps/wordpress
sudo /usr/local/bin/copia-wordpress.sh
nano compose.yaml
docker compose pull
docker compose up -d
docker compose ps

cd /opt/apps/wordpress
docker compose run --rm wpcli wp core version
docker compose run --rm wpcli wp plugin list
docker compose run --rm wpcli wp user list --fields=ID,user_login,roles

sudo tee /usr/local/bin/copia-wordpress.sh > /dev/null <<'EOF'
#!/bin/bash
# Copia diaria de WordPress · Ebenezer IT
set -euo pipefail
umask 077

DESTINO=/var/backups/wordpress
FECHA=$(date +%F)
DIAS=14

mkdir -p "$DESTINO"
cd /opt/apps/wordpress

# 1. Base de datos: entradas, páginas, usuarios, ajustes
docker compose exec -T db sh -c 'MYSQL_PWD="$MARIADB_ROOT_PASSWORD" mariadb-dump -u root --single-transaction --databases wordpress' \
    | gzip > "$DESTINO/bd-$FECHA.sql.gz"
gzip -t "$DESTINO/bd-$FECHA.sql.gz"

# 2. Archivos: temas, plugins, subidas y configuración
tar -czf "$DESTINO/archivos-$FECHA.tar.gz" -C /opt/apps/wordpress \
    .env compose.yaml php datos/html/wp-content datos/html/wp-config.php

# 3. Borrar las copias de más de $DIAS días
find "$DESTINO" -type f -mtime +$DIAS -delete

echo "Copia terminada: $(ls "$DESTINO" | wc -l) archivos, $(du -sh "$DESTINO" | cut -f1) en total"
EOF
sudo chmod 700 /usr/local/bin/copia-wordpress.sh

sudo /usr/local/bin/copia-wordpress.sh
sudo ls -lh /var/backups/wordpress/
sudo zcat /var/backups/wordpress/bd-$(date +%F).sql.gz | grep -c "CREATE TABLE"

sudo tee /etc/systemd/system/copia-wordpress.service > /dev/null <<'EOF'
[Unit]
Description=Copia de seguridad de WordPress
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/copia-wordpress.sh
EOF

sudo tee /etc/systemd/system/copia-wordpress.timer > /dev/null <<'EOF'
[Unit]
Description=Copia diaria de WordPress a las 03:45

[Timer]
OnCalendar=*-*-* 03:45:00
Persistent=true

[Install]
WantedBy=timers.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now copia-wordpress.timer
systemctl list-timers copia-wordpress.timer

cd /opt/apps/wordpress
docker compose ps
sudo ss -tlpn | grep -E ':(8082|3306) '
sudo nginx -t
sudo fail2ban-client status wordpress-login | grep "File list"
systemctl list-timers copia-wordpress.timer --no-pager
sudo certbot renew --dry-run

sudo reboot
# ...espera un minuto, ssh lab, y:
docker ps --format '{{.Names}}  {{.Status}}'