Apache was logging 172.21.0.5 (nginx container IP) for every request.
Configure RemoteIPHeader X-Real-IP and RemoteIPTrustedProxy to trust
the header nginx already sets, so access logs show actual visitor IPs.
* chaz-runner-registration-token:
revert runner token to jinja2 variable so it actually works
put jinja var in environment.j2
add gitea runner token to environment.example
gitea runner token comes from env var
Live fix applied:
- mpm_prefork.conf updated inside the running container, Apache gracefully restarted
- Workers dropped from 12 to 6, MW container memory from 230 MB to 128 MB
- Swap already recovering (494/511 vs 511/511)
Persistent changes on disk (/home/charles/pod-charlesreid1/d-mediawiki/):
- New file: charlesreid1-config/apache/mods/mpm_prefork.conf with the tuned values
- Dockerfile updated with COPY charlesreid1-config/apache/mods/mpm_prefork.conf
/etc/apache2/mods-enabled/mpm_prefork.conf
robots.txt — expanded from a blanket /w/ block to granular MediaWiki
rules matching the golly wiki (api.php, includes, languages,
maintenance, resources, serialized, skins, Special pages), with an
explicit Allow: /wiki/.
https.DOMAIN.conf.j2 — two additions:
1. map $http_user_agent $is_bot block at the top, matching the same
5 bot user-agents as golly (meta-externalagent, meta-webindexer,
ClaudeBot, Amazonbot, SemrushBot)
2. if ($is_bot) { return 429; } added to all proxied location blocks:
- /wiki/ and /w/ in the default server (charlesreid1.com)
- /wiki/ and /w/ in the www server (www.charlesreid1.com)
- / in the gitea server (git.charlesreid1.com)
Well-behaved bots see the robots.txt rules; misbehaving ones that
ignore robots.txt get a 429 at the nginx level before hitting
MediaWiki or Gitea.
* claude-plans-execute-upgrade:
add build extensions dir script
update gitignore
add php error logging
fix bootstrap2 skin for 1.39
update LocalSettings.php
upgrade to mediawiki 1.39 in mw dockerfile
bump mysql dockerfile version from 5.7 to 8.0
add mysql no root password plan
add execution notes
update plan
remove plan
add fixes for getting non-root mysql user
fix wiki backups and canary script to check for missing trailer, not just nonzero files
remove stupid dead file
add plan to fix sql backups, plus implemented fixes for sql backups
add mysql no root pw transition plan
add mediawiki upgrade plan
