peptide-repo/peptide-news-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: rawurlencode VPS token in pending query string; document GET token-auth + Coolify entrypoint requirement

Browse Source
This commit is contained in:
opencode
2026-08-03 21:42:24 +08:00
parent 42833e96b2
commit 60bc6dbf3a
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
DEPLOYMENT_PLAN.md
View File

@@ -41,11 +41,11 @@ Before deploying to WordPress, create a clean, installable ZIP archive (`peptide
2. In WordPress Admin -> **Settings -> Peptide News**:
- Under **NCBI API Key**, enter an NCBI API key (optional, increases PubMed rate limit to 10 req/sec).
- Under **VPS Worker Integration**, enter a strong secret token (e.g., `coolify_secret_token_2026`) and save.
3. Verify the REST API endpoint responds correctly:
3. Verify the REST API endpoint responds correctly. **The token MUST be sent as a query parameter for GET requests** — the shared host's LiteSpeed caches REST responses per-URI and ignores `X-LiteSpeed-Cache-Control: no-cache`, so header-only auth on GET would let a cached authenticated response leak to unauthenticated requests:
```bash
curl -i -H "X-Peptide-News-Token: coolify_secret_token_2026" \
"https://your-wordpress-site.com/wp-json/peptide-news/v1/worker/pending?limit=5"
curl -i "https://your-wordpress-site.com/wp-json/peptide-news/v1/worker/pending?limit=5&token=coolify_secret_token_2026"
```
POST routes (`/worker/update`, `/worker/ingest`) are never cached and accept the `X-Peptide-News-Token` header (or query `token`).
### Step 3: Deploy Worker Application to Coolify (Hostinger KVM8 VPS)
Use the Coolify UI or Coolify MCP to create and configure the standalone worker:
@@ -66,6 +66,7 @@ Use the Coolify UI or Coolify MCP to create and configure the standalone worker:
- **Cron Expression**: `0 * * * *` *(runs hourly)*
- **Command**: `php /app/worker.php`
- Click **Deploy** to build and launch the Alpine PHP container.
4. **IMPORTANT — keep the container alive**: the Dockerfile `CMD` runs the worker once and exits, and Coolify's scheduled tasks execute via `docker exec` (which fails while a container is restarting). Coolify ignores `start_command` for `dockerfile` build packs, so set **Custom Docker Run Options** to `--entrypoint "tail -f /dev/null"`. This is a Coolify-side setting (not in the repo), so re-apply it if the application resource is ever recreated. The scheduled task remains the only worker driver.
---

6
tools/vps-worker/worker.php
View File

@@ -86,8 +86,9 @@ function wp_rest_call( string $url, string $token, string $method = 'GET', array
}
if ( $action === 'pending' ) {
$pending_url = "{$wp_url}/wp-json/peptide-news/v1/worker/pending?limit={$batch}&token=" . rawurlencode( $token );
vps_log( "Fetching pending articles from {$wp_url}/wp-json/peptide-news/v1/worker/pending ..." );
$res = wp_rest_call( "{$wp_url}/wp-json/peptide-news/v1/worker/pending?limit={$batch}&token={$token}", $token );
$res = wp_rest_call( $pending_url, $token );
if ( ! $res || empty( $res['success'] ) ) {
vps_log( "Failed to retrieve pending articles." );
exit( 1 );
@@ -105,7 +106,8 @@ if ( $action === 'process-llm' ) {
exit( 1 );
}
vps_log( "Pulling up to {$batch} pending articles from WordPress..." );
$res = wp_rest_call( "{$wp_url}/wp-json/peptide-news/v1/worker/pending?limit={$batch}&token={$token}", $token );
$pending_url = "{$wp_url}/wp-json/peptide-news/v1/worker/pending?limit={$batch}&token=" . rawurlencode( $token );
$res = wp_rest_call( $pending_url, $token );
if ( ! $res || empty( $res['success'] ) || empty( $res['data'] ) ) {
vps_log( "No pending articles found or failed to retrieve." );
exit( 0 );