From 2171bedb204da8f59c19961c14098c5f6fa05ef7 Mon Sep 17 00:00:00 2001
From: Josh Knapp <jknapp85@gmail.com>
Date: Fri, 14 Aug 2026 07:43:20 -0700
Subject: [PATCH] feat(haproxy): ship per-site exempt list for the wp-admin
 edge gate

---
 Dockerfile               |  1 +
 scripts/start-up.sh      | 16 ++++++++++++----
 wpadmin_gate_exempt.list | 16 ++++++++++++++++
 3 files changed, 29 insertions(+), 4 deletions(-)
 create mode 100644 wpadmin_gate_exempt.list

diff --git a/Dockerfile b/Dockerfile
index feaf5f0..8618fbc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,6 +40,7 @@ COPY trusted_ips.map /etc/haproxy/trusted_ips.map
 # volume shadows /etc/haproxy with.
 COPY cloudflare_ips.list /haproxy/defaults/cloudflare_ips.list
 COPY trusted_proxies.list /haproxy/defaults/trusted_proxies.list
+COPY wpadmin_gate_exempt.list /haproxy/defaults/wpadmin_gate_exempt.list
 # Place errorfiles outside the volumed path; the HAProxy config references
 # them by absolute path.
 COPY errors /haproxy/errors
diff --git a/scripts/start-up.sh b/scripts/start-up.sh
index 975bd73..02494d2 100755
--- a/scripts/start-up.sh
+++ b/scripts/start-up.sh
@@ -27,11 +27,12 @@ mkdir -p /etc/haproxy
 # existing hosts instead of being permanently shadowed by the volume.
 # Overwrite it from the baked copy on every start.
 #
-# trusted_proxies.list is OPERATOR DATA: operators add entries directly on
-# the server and those must survive restarts/recreates. Seed it from the
-# baked copy only when it's missing; never overwrite an existing one.
+# trusted_proxies.list and wpadmin_gate_exempt.list are OPERATOR DATA:
+# operators add entries directly on the server and those must survive
+# restarts/recreates. Seed each from the baked copy only when it's missing;
+# never overwrite an existing one.
 #
-# Both branches fall back to an empty file if the baked default is somehow
+# All branches fall back to an empty file if the baked default is somehow
 # absent, because "acl ... -f <missing file>" is a fatal HAProxy config
 # error -- the list files must exist unconditionally by the time HAProxy starts.
 if [ -f /haproxy/defaults/cloudflare_ips.list ]; then
@@ -46,6 +47,13 @@ if [ ! -f /etc/haproxy/trusted_proxies.list ]; then
         : > /etc/haproxy/trusted_proxies.list
     fi
 fi
+if [ ! -f /etc/haproxy/wpadmin_gate_exempt.list ]; then
+    if [ -f /haproxy/defaults/wpadmin_gate_exempt.list ]; then
+        cp /haproxy/defaults/wpadmin_gate_exempt.list /etc/haproxy/wpadmin_gate_exempt.list
+    else
+        : > /etc/haproxy/wpadmin_gate_exempt.list
+    fi
+fi
 
 cron &
 
diff --git a/wpadmin_gate_exempt.list b/wpadmin_gate_exempt.list
new file mode 100644
index 0000000..ef7ae9e
--- /dev/null
+++ b/wpadmin_gate_exempt.list
@@ -0,0 +1,16 @@
+# Per-site opt-out from the WordPress admin edge gate.
+#
+# Hostnames listed here are EXEMPT: unauthenticated /wp-admin/* requests for
+# these sites pass through to PHP instead of being redirected to wp-login.php.
+# One hostname per line, lowercase. Matched against the Host header.
+#
+# Referenced by templates/hap_listener.tpl:
+#   acl wp_gate_exempt hdr(host),lower -f /etc/haproxy/wpadmin_gate_exempt.list
+#
+# Add a site here when a plugin legitimately serves unauthenticated visitors
+# from a /wp-admin/ URL that is not in the rule's allowlist. Symptom: "my
+# plugin's admin page redirects to login".
+#
+# Do NOT commit real customer domains — this repo is mirrored publicly. Add
+# entries directly on the server; the file lives in the /etc/haproxy named
+# volume and persists across container recreates.