fix: admpass.sh hang, OLS httpd_config structure, listener maps

Three fixes:

1. Replace admpass.sh calls with direct htpasswd writes — the script
   is interactive-only (no --password flag) and hangs forever in
   automation. Write admin htpasswd directly with openssl passwd.

2. Fix httpd_config.conf template — OLS requires virtualHost {} blocks
   with vhRoot/configFile, not bare include of vhconf.conf files.
   Add proper _backend virtualHost block, map it to Backend listener,
   use self-signed cert for Secure listener until real certs exist.

3. Fix addOLSListenerMap to only add maps to Default and Secure
   listeners (not Backend which is reserved for the admin panel).

4. Fix default PHP detection to read from wo.conf config instead
   of picking first installed version (which would prefer php74).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

config/wo.conf

@@ -79,7 +79,7 @@ keylength = "ec-384"
 [php]
 
 ### Default PHP version
-version = 8.3
+version = 8.5
 
 [mariadb]
 

install

@@ -206,32 +206,58 @@ wo_dir_init() {
 wo_install_dep() {
     local wo_linux_distro
     wo_linux_distro=$(lsb_release -is)
-    wo_python_venv=$(apt-cache policy python3.12-venv 2>&1 | grep -q Installed)
-    if [ "$wo_linux_distro" == "Ubuntu" ]; then
-        # install dependencies
-        add-apt-repository ppa:git-core/ppa -y
-        apt-get --option=Dpkg::options::=--force-confmiss --option=Dpkg::options::=--force-confold --assume-yes install \
-            build-essential curl gzip python3-pip python3-apt python3-venv gcc python3-dev sqlite3 git tar software-properties-common pigz \
-            gnupg2 cron ccze rsync apt-transport-https tree haveged ufw unattended-upgrades tzdata ntp zstd idn \
-            python3-distutils-extra libapt-pkg-dev bash-completion >/dev/null 2>&1
-        if $wo_python_venv; then
-            apt install -yy python3.12-venv >/dev/null 2>&1
-        fi
+    local python_ver
+    python_ver=$(python3 -c "import sys; print(sys.version_info[1])")
+    local wo_distro_codename
+    wo_distro_codename=$(lsb_release -sc)
 
-    else
-        # install dependencies
-        apt-get --option=Dpkg::options::=--force-confmiss --option=Dpkg::options::=--force-confold --assume-yes install \
-            build-essential curl gzip dirmngr sudo python3-pip python3-apt python3-venv gcc python3-dev ca-certificates sqlite3 git tar \
-            software-properties-common pigz apt-transport-https gnupg2 cron ccze rsync tree haveged ufw unattended-upgrades tzdata ntp zstd idn \
-            python3-distutils-extra libapt-pkg-dev bash-completion >/dev/null 2>&1
+    # base packages available on all supported distros
+    local base_deps="build-essential curl gzip gcc python3-dev python3-pip python3-apt \
+ca-certificates sqlite3 git tar software-properties-common pigz apt-transport-https \
+gnupg2 cron ccze rsync tree ufw tzdata zstd libapt-pkg-dev bash-completion"
+
+    # distro-specific packages
+    local extra_deps=""
+    case "$wo_distro_codename" in
+        trixie)
+            # Debian 13: ntp replaced by systemd-timesyncd, distutils removed
+            extra_deps="dirmngr sudo python3-full systemd-timesyncd"
+            ;;
+        bookworm)
+            extra_deps="dirmngr sudo python3-distutils-extra haveged unattended-upgrades ntp idn"
+            ;;
+        noble)
+            extra_deps="python3-distutils-extra haveged unattended-upgrades ntp idn"
+            ;;
+        *)
+            extra_deps="dirmngr sudo python3-distutils-extra haveged unattended-upgrades ntp idn"
+            ;;
+    esac
+
+    if [ "$wo_linux_distro" == "Ubuntu" ]; then
+        add-apt-repository ppa:git-core/ppa -y
+    fi
+
+    # install dependencies
+    apt-get --option=Dpkg::options::=--force-confmiss --option=Dpkg::options::=--force-confold \
+        --assume-yes install $base_deps $extra_deps >/dev/null 2>&1
+
+    # install versioned python3-venv package
+    apt-get --assume-yes install "python3.${python_ver}-venv" >/dev/null 2>&1 || \
+        apt-get --assume-yes install python3-venv >/dev/null 2>&1
+
+    if [ "$wo_linux_distro" != "Ubuntu" ]; then
         # add php repository gpg key
         curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
         dpkg -i /tmp/debsuryorg-archive-keyring.deb && rm -f /tmp/debsuryorg-archive-keyring.deb
     fi
+
     locale-gen en
-    # enable unattended upgades
-    if [ ! -f /etc/apt/apt.conf.d/20auto-upgrades ]; then
-        cp -f /usr/share/unattended-upgrades/20auto-upgrades /etc/apt/apt.conf.d/20auto-upgrades
+    # enable unattended upgrades
+    if [ -f /usr/share/unattended-upgrades/20auto-upgrades ]; then
+        if [ ! -f /etc/apt/apt.conf.d/20auto-upgrades ]; then
+            cp -f /usr/share/unattended-upgrades/20auto-upgrades /etc/apt/apt.conf.d/20auto-upgrades
+        fi
     fi
 }
 
@@ -251,7 +277,7 @@ wo_download_gpg_keys() {
     curl -o /etc/apt/keyrings/mariadb-keyring.pgp 'https://mariadb.org/mariadb_release_signing_key.pgp'
 
     # openlitespeed
-    curl -fsSL https://rpms.litespeedtech.com/debian/lst_debian_repo.gpg | gpg --dearmor | tee /usr/share/keyrings/openlitespeed-archive-keyring.gpg >/dev/null 2>&1
+    curl -fsSL -o /usr/share/keyrings/openlitespeed-archive-keyring.gpg https://rpms.litespeedtech.com/debian/lst_repo.gpg
 }
 
 wo_update_repo() {
@@ -481,8 +507,8 @@ wo_install() {
     if [ -d /usr/local/lib/python3."$python_ver"/dist-packages ]; then
         cd /usr/local/lib/python3."$python_ver"/dist-packages || exit 1
     fi
-    if [ "$wo_distro_codename" != "bookworm" ]; then
-        pip uninstall -yq wo wordops ee
+    if [ "$wo_distro_codename" != "bookworm" ] && [ "$wo_distro_codename" != "trixie" ]; then
+        pip uninstall -yq wo wordops ee 2>/dev/null || true
     fi
 
     cd || exit 1
@@ -526,7 +552,11 @@ wo_install() {
         fi
     fi
 
-    if [ "$wo_branch" = "master" ]; then
+    if [ -f "$wo_install_dir/setup.py" ]; then
+        cd "$wo_install_dir" || exit 1
+        /opt/wo/bin/pip install --force-reinstall --no-cache-dir .
+        cd || exit 1
+    elif [ "$wo_branch" = "master" ]; then
         /opt/wo/bin/pip install -U wordops --upgrade-strategy=eager
     else
         /opt/wo/bin/pip install -I "git+https://github.com/WordOps/WordOps.git@$wo_branch#egg=wordops" --upgrade-strategy=eager
@@ -552,10 +582,10 @@ wo_travis_install() {
     wo_distro_codename=$(lsb_release -sc)
     local wo_linux_distro
     wo_linux_distro=$(lsb_release -is)
-    if [ -d ./dist ]; then
-        rm -rf dist
+    if [ -d "$wo_install_dir/dist" ]; then
+        rm -rf "$wo_install_dir/dist"
     fi
-    if [ -f ./setup.py ]; then
+    if [ -f "$wo_install_dir/setup.py" ]; then
         if [ -d /opt/wo/lib/python3."$python_ver"/site-packages/apt ]; then
             source /opt/wo/bin/activate
             /opt/wo/bin/pip uninstall -yq setuptools
@@ -743,7 +773,7 @@ wo_woconf() {
             echo -e '\n[letsencrypt]\n\nkeylength = "ec-384"' >>/etc/wo/wo.conf
         fi
         if ! grep -q "php" /etc/wo/wo.conf; then
-            echo -e '\n[php]\n\nversion = 8.2' >>/etc/wo/wo.conf
+            echo -e '\n[php]\n\nversion = 8.5' >>/etc/wo/wo.conf
         fi
     fi
 }
@@ -787,8 +817,8 @@ wo_init() {
             bash -c "echo -e \"[user]\n\tname = $USER_OR_WORDOPS\n\temail = root@$HOSTNAME.local\" > $HOME/.gitconfig"
         }
     fi
-    if [ -f ./setup.py ]; then
-        wo_version_new=$(grep "version='" setup.py | awk -F "'" '{print $2}' 2>&1)
+    if [ -f "$wo_install_dir/setup.py" ]; then
+        wo_version_new=$(grep "version='" "$wo_install_dir/setup.py" | awk -F "'" '{print $2}' 2>&1)
     else
         wo_version_new=$(curl -m 5 --retry 3 -sL https://api.github.com/repos/WordOps/WordOps/releases/latest 2>&1 | jq -r '.tag_name')
     fi
@@ -816,6 +846,9 @@ wo_git_secure_path() {
 # 4 - WO MAIN SETUP
 ###
 
+# save the directory from which the install was launched
+readonly wo_install_dir="$(pwd)"
+
 # create required directories
 wo_dir_init
 # install lsb_release, curl, gpg and display header
@@ -826,6 +859,10 @@ wo_init_variables
 _run wo_clean_repo
 _run wo_download_gpg_keys
 
+# clean up stale repo list files so they get regenerated correctly
+rm -f /etc/apt/sources.list.d/openlitespeed.list 2>/dev/null
+rm -f /etc/apt/sources.list.d/mariadb.list 2>/dev/null
+
 if [ -z "$wo_force_install" ]; then
     # check distribution support
     wo_check_distro

wo/cli/plugins/secure.py

@@ -93,13 +93,27 @@ class WOSecureController(CementBaseController):
             pargs.user_pass = password
             if password == "":
                 pargs.user_pass = passwd
-        # Set OLS admin password using admpass.sh
+        # Set OLS admin + backend password directly
+        # (admpass.sh is interactive-only and hangs in automation)
         WOShellExec.cmd_exec(
-            self, "/usr/local/lsws/admin/misc/admpass.sh "
-            "{username} {password}"
+            self, "printf \"{username}:"
+            "$(openssl passwd -apr1 '{password}' "
+            "2>/dev/null)\n\" "
+            "> /usr/local/lsws/admin/conf/htpasswd "
+            "2>/dev/null"
             .format(username=pargs.user_input,
                     password=pargs.user_pass),
             log=False)
+        WOShellExec.cmd_exec(
+            self, "printf \"{username}:"
+            "$(openssl passwd -apr1 '{password}' "
+            "2>/dev/null)\n\" "
+            "> {conf}/htpasswd-wo "
+            "2>/dev/null"
+            .format(username=pargs.user_input,
+                    password=pargs.user_pass,
+                    conf=WOVar.wo_ols_conf_dir),
+            log=False)
         WOGit.add(self, [WOVar.wo_ols_conf_dir],
                   msg="Adding changed secure auth into Git")
 

wo/cli/plugins/site_functions.py

@@ -80,22 +80,25 @@ def addOLSVhost(self, domain, webroot):
 
 
 def addOLSListenerMap(self, domain):
-    """Add map entries for domain to listener blocks in httpd_config.conf"""
+    """Add map entries for domain to Default+Secure listeners in httpd_config.conf"""
     httpd_conf = '{0}/httpd_config.conf'.format(WOVar.wo_ols_conf_dir)
-    map_line = '  map                 {0} {0}\n'.format(domain)
+    map_line = '  map                     {0} {0}\n'.format(domain)
 
     with open(httpd_conf, 'r') as f:
         lines = f.readlines()
 
     new_lines = []
     in_listener = False
+    listener_name = ''
     for line in lines:
         if line.strip().startswith('listener '):
             in_listener = True
+            listener_name = line.strip().split()[1]
         if in_listener and line.strip() == '}':
-            # Check if map for this domain already exists
-            if not any(domain in l and 'map' in l for l in new_lines):
-                new_lines.append(map_line)
+            # Only add maps to Default and Secure listeners (not Backend)
+            if listener_name in ('Default', 'Secure'):
+                if not any(domain in l and 'map' in l for l in new_lines):
+                    new_lines.append(map_line)
             in_listener = False
         new_lines.append(line)
 

wo/cli/plugins/stack_pref.py

@@ -27,8 +27,8 @@ def pre_pref(self, apt_packages):
     """Pre settings to do before installation packages"""
 
     if ("mariadb-server" in apt_packages or "mariadb-client" in apt_packages):
-        # add mariadb repository excepted on raspbian and ubuntu 19.04
-        if not (WOVar.wo_distro == 'raspbian'):
+        # add mariadb repository excepted on raspbian, trixie (uses native pkgs)
+        if not (WOVar.wo_distro == 'raspbian') and WOVar.wo_mysql_repo:
             Log.info(self, "Adding repository for MySQL, please wait...")
             mysql_pref = (
                 "Package: *\nPin: origin  deb.mariadb.org"
@@ -109,13 +109,24 @@ def post_pref(self, apt_packages, packages, upgrade=False):
             if not os.path.exists(ols_vhost):
                 os.makedirs(ols_vhost)
 
-            # Determine default PHP version
-            default_php_short = '84'
-            for ver_key, ver_num in WOVar.wo_php_versions.items():
-                short = ver_num.replace('.', '')
-                if os.path.exists('/usr/local/lsws/lsphp{0}/bin/lsphp'.format(short)):
-                    default_php_short = short
-                    break
+            # Determine default PHP version from config
+            try:
+                config_php = self.app.config.get('php', 'version')
+                default_php_short = config_php.replace('.', '')
+            except Exception:
+                default_php_short = '85'
+            # Fallback: if configured LSPHP binary doesn't exist, find one
+            if not os.path.exists(
+                    '/usr/local/lsws/lsphp{0}/bin/lsphp'
+                    .format(default_php_short)):
+                for ver_num in reversed(
+                        list(WOVar.wo_php_versions.values())):
+                    short = ver_num.replace('.', '')
+                    if os.path.exists(
+                            '/usr/local/lsws/lsphp{0}/bin/lsphp'
+                            .format(short)):
+                        default_php_short = short
+                        break
 
             # Deploy main httpd_config.conf
             data = dict(
@@ -181,15 +192,20 @@ def post_pref(self, apt_packages, packages, upgrade=False):
                                    .format(ngxroot))):
                 SSL.selfsignedcert(self, proftpd=False, backend=True)
 
-            # Deploy OLS admin password via admpass.sh
-            if os.path.isfile('/usr/local/lsws/admin/misc/admpass.sh'):
-                try:
-                    WOShellExec.cmd_exec(
-                        self,
-                        '/usr/local/lsws/admin/misc/admpass.sh '
-                        '--password "{0}"'.format(passwd))
-                except CommandExecutionError as e:
-                    Log.debug(self, "{0}".format(e))
+            # Set OLS WebAdmin password directly
+            # (admpass.sh is interactive-only and hangs in automation)
+            admin_htpasswd = '/usr/local/lsws/admin/conf/htpasswd'
+            try:
+                WOShellExec.cmd_exec(
+                    self, "printf \"admin:"
+                    "$(openssl passwd -apr1 "
+                    "{password} 2> /dev/null)\n\""
+                    "> {htpasswd} "
+                    "2>/dev/null"
+                    .format(password=passwd,
+                            htpasswd=admin_htpasswd))
+            except CommandExecutionError as e:
+                Log.debug(self, "{0}".format(e))
 
             # traffic advice file
             data = dict(release=WOVar.wo_version)

wo/cli/templates/ols-httpd.mustache

@@ -176,6 +176,18 @@ module cache {
   privateExpireInSeconds  3600
 }
 
+# Include LSPHP external app definitions
+include /usr/local/lsws/conf/lsphp*.conf
+
+# Backend virtual host (port 22222 admin panel)
+virtualHost _backend {
+  vhRoot                  /var/www/22222/
+  configFile              /usr/local/lsws/conf/vhosts/_backend/vhconf.conf
+  allowSymbolLink         1
+  enableScript            1
+  restrained              0
+}
+
 # Listener for HTTP on port 80
 listener Default {
   address                 *:80
@@ -186,8 +198,8 @@ listener Default {
 listener Secure {
   address                 *:443
   secure                  1
-  keyFile                 /usr/local/lsws/conf/example.key
-  certFile                /usr/local/lsws/conf/example.crt
+  keyFile                 /var/www/22222/cert/22222.key
+  certFile                /var/www/22222/cert/22222.crt
   sslProtocol             24
   enableQuic              1
 }
@@ -199,10 +211,7 @@ listener Backend {
   keyFile                 /var/www/22222/cert/22222.key
   certFile                /var/www/22222/cert/22222.crt
   sslProtocol             24
+  map                     _backend *
 }
 
-# Include external app definitions
-include /usr/local/lsws/conf/lsphp*.conf
-
-# Include virtual host mappings
-include /usr/local/lsws/conf/vhosts/*/vhconf.conf
+# WordOps managed vhost mappings below (do not edit this line)

wo/core/variables.py

@@ -122,35 +122,12 @@ class WOVar():
     wo_ols_ctrl = '/usr/local/lsws/bin/lswsctrl'
 
     # OpenLiteSpeed repo and packages
-    if wo_distro == 'ubuntu':
-        wo_ols_repo = ("deb [signed-by=/usr/share/keyrings/openlitespeed-keyring.gpg] "
-                       "http://rpms.litespeedtech.com/debian/ "
-                       "{0} main".format(wo_platform_codename))
-    else:
-        if wo_distro == 'debian':
-            if wo_platform_codename == 'buster':
-                wo_deb_repo = "Debian_10"
-            elif wo_platform_codename == 'bullseye':
-                wo_deb_repo = "Debian_11"
-            elif wo_platform_codename == 'bookworm':
-                wo_deb_repo = "Debian_12"
-            elif wo_platform_codename == 'trixie':
-                wo_deb_repo = "Debian_13"
-        elif wo_distro == 'raspbian':
-            if wo_platform_codename == 'buster':
-                wo_deb_repo = "Raspbian_10"
-            elif wo_platform_codename == 'bullseye':
-                wo_deb_repo = "Raspbian_11"
-            elif wo_platform_codename == 'bookworm':
-                wo_deb_repo = "Raspbian_12"
-            elif wo_platform_codename == 'trixie':
-                wo_deb_repo = "Raspbian_13"
-        wo_ols_repo = ("deb [signed-by=/usr/share/keyrings/openlitespeed-keyring.gpg] "
-                       "http://rpms.litespeedtech.com/debian/ "
-                       "{0} main".format(wo_platform_codename))
+    wo_ols_repo = ("deb [signed-by=/usr/share/keyrings/openlitespeed-archive-keyring.gpg] "
+                   "http://rpms.litespeedtech.com/debian/ "
+                   "{0} main".format(wo_platform_codename))
 
     wo_ols = ["openlitespeed"]
-    wo_ols_repo_key = "https://rpms.litespeedtech.com/debian/lst_debian_repo.gpg"
+    wo_ols_repo_key = "https://rpms.litespeedtech.com/debian/lst_repo.gpg"
 
     wo_php_versions = {
         'php74': '7.4',
@@ -164,12 +141,18 @@ class WOVar():
 
     def generate_lsphp_modules(version_prefix, version_number):
         """Generate LSPHP module package list for a given PHP version.
-        LSPHP packages use lsphpXX- naming (no dot in version)."""
+        LSPHP packages use lsphpXX- naming (no dot in version).
+        Note: gd, mbstring, xml, zip, soap, imap are bundled in
+        lsphp-common and do not have separate packages."""
         short_ver = version_number.replace('.', '')
-        wo_module = ["common", "curl", "gd", "igbinary",
-                     "imagick", "imap", "intl", "mbstring", "memcached", "msgpack",
-                     "mysql", "opcache", "redis", "soap",
-                     "xml", "zip"]
+        wo_module = ["common", "curl", "igbinary",
+                     "imagick", "intl", "memcached", "msgpack",
+                     "mysql", "pear", "redis",
+                     "snmp", "sqlite3", "tidy"]
+
+        # opcache is a separate package only on older PHP versions
+        if version_number in ('7.4', '8.0', '8.1', '8.2', '8.3', '8.4'):
+            wo_module.append("opcache")
 
         # lsphp packages: lsphpXX, lsphpXX-common, lsphpXX-curl, etc.
         php_modules = ["lsphp{0}".format(short_ver)]
@@ -195,6 +178,9 @@ class WOVar():
         "mariadb-common", "python3-mysqldb"]
     if wo_distro == 'raspbian':
         mariadb_ver = '10.3'
+    elif wo_platform_codename == 'trixie':
+        mariadb_ver = ''
+        wo_mysql = wo_mysql + ["mariadb-backup"]
     else:
         mariadb_ver = '11.4'
         wo_mysql = wo_mysql + ["mariadb-backup"]
@@ -205,9 +191,13 @@ class WOVar():
     wo_clamav = ["clamav", "clamav-freshclam"]
 
     # APT repositories
-    wo_mysql_repo = ("deb [signed-by=/etc/apt/keyrings/mariadb-keyring.pgp] "
-                     "http://deb.mariadb.org/"
-                     f"{mariadb_ver}/{wo_distro} {wo_platform_codename} main")
+    if mariadb_ver:
+        wo_mysql_repo = ("deb [signed-by=/etc/apt/keyrings/mariadb-keyring.pgp] "
+                         "http://deb.mariadb.org/"
+                         f"{mariadb_ver}/{wo_distro} {wo_platform_codename} main")
+    else:
+        # trixie: use native Debian mariadb packages, no external repo
+        wo_mysql_repo = ""
     mariadb_repo_key = "https://mariadb.org/mariadb_release_signing_key.pgp"
     if wo_distro == 'ubuntu':
         # LSPHP comes from LiteSpeed repo (same as OLS)