WP cron in development needs to use curl -k

[erikbelusic]

noticed my WPcrons werent running. bedrock disables them, but my trellis config has

system_cron: true

in the wordpress_sites.yml

i checked the production server, and found that no crons were set up with the following:

MYUSER@MYHOSTNAME:~$ for user in $(cut -f1 -d: /etc/passwd); do sudo crontab -u $user -l; done
no crontab for root
no crontab for daemon
no crontab for bin
no crontab for sys
no crontab for sync
no crontab for games
no crontab for man
no crontab for lp
no crontab for mail
no crontab for news
no crontab for uucp
no crontab for proxy
no crontab for www-data
no crontab for backup
no crontab for list
no crontab for irc
no crontab for gnats
no crontab for nobody
no crontab for libuuid
no crontab for syslog
no crontab for messagebus
no crontab for landscape
no crontab for sshd
no crontab for colord
no crontab for ntp
no crontab for web
no crontab for MYUSER
no crontab for mysql
no crontab for memcache

am i doing something wrong or is this a bug?

[swalkinshaw]

We use a separate cron file for this. See here.

The path it exists at is something like /etc/cron.d/wordpress-example_com.

I just tested a default Trellis install and this file exists. Running your script says "no crontab" for all users though so I'm not sure that command finds files in cron.d.

Is the cron actually not working? Or you just couldn't find it?

[erikbelusic]

i do not believe that the cron is working. i have a backup plugin thats supposed to run once a day and it hasn't ran. it could be a plugin issue.

i have found the file in the cron.d folder and it looks to be set up correctly. is there a log for the cron that i can look at to see if its being run successfully or not? or should i write something dumb in a wordpress plugin that sends me an email when the cron runs?

[swalkinshaw]

Try /var/log/syslog and grep for CRON. But yeah you can always do that test. Or schedule a post to be published.

[louim]

Don't forget that the default cron is set to run each 15 minutes. So there may be a delay of up to 15 minutes after the time you set you post to be published before it actually is processed.

[erikbelusic]

i have found the issue! i am using a self signed certificate and the curl request is failing. is there an appropriate way to add the -k flag to my cron via trellis, rather than editing the cron directly?

[austinpray]

@erikbelusic this looks like it needs to be fixed in the upstream. I'm guessing we need to add -k for all self-signed cert users. I don't think you are the only person to be susceptible to this bug.

edit: or we could add the self-signed cert to the machine's root CAs.

[swalkinshaw]

@erikbelusic great debugging! @austinpray is correct that this needs to be fixed in Trellis. We'll need to check for SSL on development in here

trellis/roles/wordpress-setup/tasks/main.yml

Line 26 in d8c6550

job="curl -s {{ item.value.env.wp_siteurl }}/wp-cron.php"

.

I renamed this issue to reflect the problem.

[swalkinshaw]

@austinpray also had a good idea to add the self-signed certificate as a root cert so it's recognized as valid.

[louim]

Haven't tried, but can't we call php directly without making an http request?

Something like

*/15 * * * * php /srv/website/current/web/wp/wp-cron.php

[austinpray]

I'd prefer to keep curl. php-cli scripts do not timeout. So if WordPress or a plugin does something horrible you can possibly get stuck with a hung process. Also curl runs the code through fpm.

[erikbelusic]

Which route do you think you want to go? I have no problem helping out. Especially since u guys did all this awesome work for the community this far =]

[swalkinshaw]

Looking at this: http://unix.stackexchange.com/questions/90450/adding-a-self-signed-certificate-to-the-trusted-list

@austinpray I'm not even sure that the curl command would support the "trusted" route.

@erikbelusic it would be great if you could test out the two methods in that post. See if curl works after doing the ca-certificates method and also using the curl --cacert /path/to/CA/cert.file https://... method.

[erikbelusic]

@swalkinshaw @austinpray - my findings thus far...

WORKING: (same command)

curl --insecure https://mysite.com/wp/wp-cron.php

OR

curl -k https://mysite.com/wp/wp-cron.php

ALSO WORKING:

curl --cacert /etc/nginx/ssl/mysite.com_self_signed.pem https://mysite.com/wp/wp-cron.php

NOT WORKING:

cp /etc/nginx/ssl/mysite.com_self_signed.pem /usr/share/ca-certificates

followed by

dpkg-reconfigure ca-certificates

followed by choosing "ask" presents a list of certificates, however the self signed certificate does not appear. i may have did something wrong though... not sure

out of the two above options, the --cacert flag looks like the best option because it explicitly allowing our self signed certificate whereas the other --insecure or -k flag will allow any connection with an untrusted certificate.

we should check for a self signed cert and alter cron command to include the --cacert flag with the path to the self signed cert.

i am not exactly sure how to do this. i know control structures aren't supported in .yml files, but i see you can trigger different tasks conditionally using the when directive within ansible. i could use some guidance here....

[swalkinshaw]

@erikbelusic this is great. Thanks for testing these out.

I agree that the best solution is the --cacert for curl for the reason you mentioned.

You can actually can use control structures/Jinja in the YML files. It just gets ugly and should ideally be avoided. Example: https://github.com/nickjj/ansible-ferm/blob/v0.1.2/tasks/main.yml#L33-L37

The solution is probably to duplicate the Cron task and modify the when conditional. Maybe register the Generate self-signed certificates task as a variable and check if its defined in the cron task. If its not, then there's no self-signed cert. If it is, then there is and use the --cacert option.

[erikbelusic]

ill give it a shot and see if i can make it work.

[erikbelusic]

i am not completely understanding register the Generate self-signed certificates task as a variable and check if its defined in the cron task. where would that be done? in the group_vars or else where?

what i am currently thinking is that in the existing cron task, we can check if ssl: true and key and cert are both undefined and add on the --cacert flag that way, but it does look quite messy.

{% if item.value.ssl is defined and item.value.ssl and item.value.ssl.key is not defined and item.value.ssl.cert is not defined %}
job="curl -s --cacert /etc/nginx/ssl/{{ item.key }}_self_signed.pem {{ item.value.env.wp_siteurl }}/wp-cron.php"
{% else %}
job="curl -s {{ item.value.env.wp_siteurl }}/wp-cron.php"
{% endif %}

currently untested

[swalkinshaw]

@erikbelusic the registration would be done where the task is done. Just by adding register: <var_name>.

I believe that variable would be available during the cron task. See http://docs.ansible.com/ansible/playbooks_variables.html#registered-variables

I suggested the variable method because as you figured out that conditional is quite messy.

[swalkinshaw]

@erikbelusic thanks for reporting and debugging this. Decided to go with the simple -k solution.