Merge pull request #32 from roots/web-folder

Better webroot structure (web/)

.gitignore

@@ -1,6 +1,6 @@
 # WordPress
-wp
-.htaccess
+web/wp
+web/.htaccess
 
 # WP-CLI
 db-sync
@@ -12,12 +12,14 @@ sql-dump-*.sql
 !.env.example
 
 # Application
-app/uploads
-app/upgrade
-app/plugins/*
-!app/plugins/.gitkeep
-app/mu-plugins/*
-!app/mu-plugins/register-theme-directory.php
+web/app/plugins/*
+!web/app/plugins/.gitkeep
+web/app/mu-plugins/*
+!web/app/mu-plugins/.gitkeep
+web/app/upgrade
+web/app/uploads/*
+!web/app/uploads/.gitkeep
+!web/app/mu-plugins/register-theme-directory.php
 
 # Vendor (e.g. Composer)
 vendor/*

CHANGELOG.md

@@ -1,3 +1,7 @@
+### HEAD
+
+* Better webroot structure: introduces the `/web` directory as the document/web root for web server vhosts
+
 ### 1.0.0: 2013-12-18
 
 * Initial release

README.md

@@ -54,6 +54,7 @@ To skip the scripts completely, `create-project` can be run with `--no-scripts`
   * `WP_SITEURL` - Full URL to WordPress including subdirectory (http://example.com/wp)
 3. Add theme(s)
 4. Access WP Admin at `http://example.com/wp/wp-admin`
+5. Set your Nginx or Apache vhost to `/path/to/site/web/` (`/path/to/site/current/web/` if using Capistrano)
 
 ### Manually
 
@@ -69,6 +70,7 @@ To skip the scripts completely, `create-project` can be run with `--no-scripts`
   * `WP_SITEURL` - Full URL to WordPress including subdirectory (http://example.com/wp)
 4. Add theme(s)
 5. Access WP Admin at `http://example.com/wp/wp-admin`
+6. Set your Nginx or Apache vhost to `/path/to/site/web/` (`/path/to/site/current/web/` if using Capistrano)
 
 Using Capistrano for deploys?
 
@@ -93,18 +95,17 @@ See http://capistranorb.com/documentation/getting-started/authentication-and-aut
 4. Run the normal deploy command: `bundle exec cap <stage> deploy`
 5. Enjoy one-command deploys!
 
+* Edit stage/environment configs in `config/deploy/` to set the roles/servers and connection options.
+
 ## Documentation
 
 ### Folder Structure
 
 ```
-├── app
-│   ├── mu-plugins
-│   ├── plugins
-│   └── themes
 ├── Capfile
 ├── composer.json
 ├── config
+│   ├── application.php
 │   ├── deploy
 │   │   ├── staging.rb
 │   │   └── production.rb
@@ -115,23 +116,30 @@ See http://capistranorb.com/documentation/getting-started/authentication-and-aut
 │   │   └── production.php
 │   └── application.php
 ├── Gemfile
-├── index.php
 ├── vendor
-├── wp-config.php
-└── wp
+└── web
+    ├── app
+    │   ├── mu-plugins
+    │   ├── plugins
+    │   └── themes
+    ├── wp-config.php
+    ├── index.php
+    └── wp
 ```
 
 The organization of Bedrock is similar to putting WordPress in its own subdirectory but with some improvements.
 
+* In order not to expose sensetive files in the webroot, Bedrock moves what's required into a `web/` directory including the vendor'd `wp/` source, and the `wp-content` source.
 * `wp-content` (or maybe just `content`) has been named `app` to better reflect its contents. It contains application code and not just "static content". It also matches up with other frameworks such as Symfony and Rails.
-* `wp-config.php` remains in the root because it's required by WP, but it only acts as a loader. The actual configuration files have been moved to `config/` for better separation.
+* `wp-config.php` remains in the `web/` because it's required by WP, but it only acts as a loader. The actual configuration files have been moved to `config/` for better separation.
 * Capistrano configs are also located in `config/` to make it consistent.
 * `vendor/` is where the Composer managed dependencies are installed to.
 * `wp/` is where the WordPress core lives. It's also managed by Composer but can't be put under `vendor` due to WP limitations.
 
+
 ### Configuration Files
 
-The root `wp-config.php` is required by WordPress and is only used to load the other main configs. Nothing else should be added to it.
+The root `web/wp-config.php` is required by WordPress and is only used to load the other main configs. Nothing else should be added to it.
 
 `config/application.php` is the main config file that contains what `wp-config.php` usually would. Base options should be set in there.
 
@@ -144,36 +152,6 @@ Note: You can't re-define constants in PHP. So if you have a base setting in `ap
 * Remove the base option and be sure to define it in every environment it's needed
 * Only define the constant in `application.php` if it isn't already defined.
 
-**Security warning**: You'll want to block configuration files from being publicly accessible (we'll do this automatically once we have Vagrant/server configs)
-
-Nginx:
-
-```nginx
-location ~ /(config|Capfile|Gemfile(\.lock)?|composer(\.lock|\.json)|\.env) {
-  deny all;
-}
-```
-
-Apache (in `.htaccess`):
-
-```apache
-<FilesMatch "/(config|Capfile|Gemfile(\.lock)?|composer(\.lock|\.json)|\.env)">
-
-    # Apache < 2.3
-    <IfModule !mod_authz_core.c>
-        Order allow,deny
-        Deny from all
-        Satisfy All
-    </IfModule>
-
-    # Apache ≥ 2.3
-    <IfModule mod_authz_core.c>
-        Require all denied
-    </IfModule>
-
-</FilesMatch>
-```
-
 #### Don't want it?
 
 You will lose the ability to define environment specific settings.

composer.json

@@ -64,11 +64,11 @@
   },
   "extra": {
     "installer-paths": {
-      "app/plugins/{$name}/": ["type:wordpress-plugin"],
-      "app/mu-plugins/{$name}/": ["type:wordpress-muplugin"],
-      "app/themes/{$name}/": ["type:wordpress-theme"]
+      "web/app/plugins/{$name}/": ["type:wordpress-plugin"],
+      "web/app/mu-plugins/{$name}/": ["type:wordpress-muplugin"],
+      "web/app/themes/{$name}/": ["type:wordpress-theme"]
     },
-    "webroot-dir": "wp",
+    "webroot-dir": "web/wp",
     "webroot-package": "wordpress"
   }
 }

config/application.php

@@ -1,5 +1,6 @@
 <?php
-$root_dir = dirname(dirname(__FILE__));
+$root_dir = dirname(__DIR__);
+$webroot_dir = $root_dir . '/web';
 
 /**
  * Use Dotenv to set required environment variables and load .env file in root
@@ -23,7 +24,7 @@
  * Custom Content Directory
  */
 define('CONTENT_DIR', '/app');
-define('WP_CONTENT_DIR', $root_dir . CONTENT_DIR);
+define('WP_CONTENT_DIR', $webroot_dir . CONTENT_DIR);
 define('WP_CONTENT_URL', WP_HOME . CONTENT_DIR);
 
 /**
@@ -64,5 +65,5 @@
  * Bootstrap WordPress
  */
 if (!defined('ABSPATH')) {
-  define('ABSPATH', $root_dir . '/wp/');
+  define('ABSPATH', $webroot_dir . '/wp/');
 }

wp-config.php → web/wp-config.php

@@ -4,6 +4,6 @@
  * This file is required in the root directory so WordPress can find it.
  * WP is hardcoded to look in its own directory or one directory up for wp-config.php.
  */
-require_once('vendor/autoload.php');
-require_once('config/application.php');
+require_once(dirname(__DIR__) . '/vendor/autoload.php');
+require_once(dirname(__DIR__) . '/config/application.php');
 require_once(ABSPATH . 'wp-settings.php');