WordPress sites

Besides static hotsites, rapadura creates WordPress sites inside the rapadura.net multisite. It is for people who prefer editing content in WordPress, or for an agent that builds the site through the REST API and wp-cli.

Each site is a subsite name.rapadura.net. You are its administrator and nothing else's. Available themes and plugins are the ones the administrator enabled on the network.

Create

rapadura wp blueprints
rapadura wp create meetup-sobral --blueprint event --title "Meetup Sobral" --email you@example.com

• --blueprint: blank (just the site), event (home, schedule, speakers, venue, registration), meetup, course. Pages come with placeholder text for the agent to replace.
• --email: needed the first time only. It becomes your WordPress account's email and is remembered.

The answer carries the address, the wp-admin URL, your WordPress login (derived from GitHub, letters and digits only) and an application password shown exactly once. It gives your agent REST API access as you, on that site only. Treat it like a token; if it leaks, revoke it in your WordPress profile.

Edit through the REST API

With the login and the application password any HTTP client works:

curl -u "yourlogin:xxxx xxxx xxxx xxxx xxxx xxxx" \
  https://meetup-sobral.rapadura.net/wp-json/wp/v2/pages

Creating pages, uploading images, building menus is a matter of endpoint; the API documentation is WordPress's own. The same password does not work on other sites of the network: it gets 403.

Edit through wp-cli

Everything after -- goes to wp-cli, already pinned to your site and your user. Do not pass --url, --path or --user; the gateway sets them.

rapadura wp meetup-sobral -- post list --post_type=page --format=json
rapadura wp meetup-sobral -- post create --post_type=page --post_title="Sponsors" --post_status=publish
rapadura wp meetup-sobral -- option update blogdescription "PHP community of Ceará"
rapadura wp meetup-sobral -- menu create main
rapadura wp meetup-sobral -- cache flush

Output and exit status are wp-cli's own. With --json you get stdout, stderr and exit_code separately.

What is allowed

Allowed by default: post, post-type, term, taxonomy, menu, media, comment, widget, sidebar, option, transient, cron, rewrite, cache, embed, search-replace (the site's own tables only), export, import, help, and parts of user (list, create, roles on your site), plugin (list, activate, deactivate), theme (list, activate) and site (option, meta).

Always refused, with an explanation: eval, eval-file, shell, db, config, core, network, super-admin, language, maintenance-mode, package, scaffold, installing or deleting plugins and themes, deleting users, and the flags --network, --all-tables, --url, --path, --user, --require, --exec, --ssh. A command not on the list is refused until the administrator allows it.

Logging into wp-admin

Your WordPress account starts without a known password. To use the browser:

rapadura wp password meetup-sobral

Shows a fresh password once. It is your user's password across the network (you only have access to your own sites). Change it in your profile if you like.

New credentials

rapadura wp credentials meetup-sobral

Mints another application password. Older ones keep working until you revoke them in your WordPress profile.

Taking a site offline

rapadura sites delete meetup-sobral --yes

The site is archived, not deleted: visitors see a notice, the content is kept, and the administrator can restore it.

Limits and caveats

• WordPress sites have no versions and no rollback; history is WordPress's own revisions.
• Upload space per site is the network's (100 MB today).
• Only the rapadura.net domain for now. Custom domains and phpcomrapadura.org for WordPress sites come later, with approval.
• Every wp-cli call lands in the audit log with the full command. Do not pass secrets as arguments.