The cnto-wp-website from cntodev

Backend Security Check

Before we are able to switch from enjin to WP it's vital that we do a thorough security check in the backend of both WP and the hardware it's stored:

WP

disable Theme Editor
disable Plugin Editor
change default Login url
install one main WP security plugin (Cerber, Defender, Wordfence, Sucuri etc.)

Synology NAS

install anti-virus software

@enrico-ghidoni I can give you temporary access to the NAS for this if you need it. Feel free to mention any tickboxes I need to add to the OP that we should investigate for security purposes.

Revamp the visuals of the registration page

https://cnto-arma.com/register/

Currently, the site registration page looks very drab with bog-standard WP format.

CNTR Page

https://cnto-arma.com/

CNTR page needs to be added to the header and linked correctly: http://priv.carpenoctem.co/cntr/

Embedding of CNTR onto the Website

Currently, CNTR is just a link to an external website.

If possible we should try to embed the CNTR functionality directly onto the website to keep everything on the same URL / UI.

Forums Page

https://cnto-arma.com/forums/

A new page with updated visuals needs to be created: https://www.carpenoctem.co/forums

Potentially cut down on forums bloat by merging some current sub-forums into one.

When the structure of the forums is complete and issue #9 has been resolved:

go through the entire forums and assign & double-check all user permissions

Forums Colour Rebalancing

https://cnto-arma.com/forums/

@enrico-ghidoni pointed out that the current colours are a bit harsh. He will attempt to rebalance them to make it a bit softer.

The idea behind the first colour scheme was to go for a discord-esque vibe but with yellow as the accent colour. However, I've just slapped some stuff together quickly for a functional use case and haven't balanced it properly yet.

Live feeds of our Main Services

Have a visually pleasing live feed of our main services:

TeamSpeak
Discord
Game Servers (players online, map loaded etc.)

Events Calendar Page

A new page with updated visuals needs to be created: https://www.carpenoctem.co/events

Back-End Naming Convention

https://cnto-arma.com/wordpress/wp-admin/post.php?post=9&action=edit

I've created a uniform naming convention for Divi containers on the back-end of the "Home" page (see link above).

To ensure long-term easy maintenance of the content management system (CMS) it's important to establish a naming convention on the back-end so future power users less familiar with the backend structure can easily edit content and emulate the same naming convention on new pages.

The following existing Divi pages need to be updated to the same standard to create a solid foundation for future page expansions.

In addition, I've also started to curate the Divi Library, a feature where you can save example site elements such as Sections and Rows for copy paste usage later. Kind of a Lego principle with pre-made building blocks

All members of CntoDev have view access to this repository

After transferring this repo from my account to the CntoDev organisation account an unintended bug appeared: by default all organisation members (24 people) have view access to all repositories.

This means uploading the actual code of the website is on hold until we can ensure not to leak private user data.

For now, going to continue using this repo as an issue tracker mainly.

Wiki Page

This page is going to be the revival of an older project: https://www.carpenoctem.co/forums/m/26081621/viewthread/32205277-community-wiki

To eliminate the bloated navigation of our current website a lot of individual pages can be centralised into the wiki:

User Management System

Setup BuddyPress so it mirrors our current enjin user roles, tags, automations etc.

Configure basic WordPress instance on `tools` server

Start the deployment of a barebone WordPress instance on the tools server to resume work on the project after backup failure.

Application Form Page

A new page with updated visuals needs to be created: https://www.carpenoctem.co/join

Deployment solution

As discussed in private between myself and @JamesTheClarke as well as during R&D branch meeting on 11/02/2021, we need to come up with a decision on where to deploy the finished website.

Mentioned options include:

Existing tools server
External, WP-dedicated hosting solution
New VM to be added to our infrastructure

Factors to take into account:

Security risk
Maintainability, updates
Performances linked with network config and hardware resources

My personal concerns on deploying the new website on our machines, specifically the tools server, is that no member of the community as of now (and presumably in the future) is highly proficient in IT security, and since WordPress is known to be a generally unsafe product constant security checks are something to look at. As suggested by both @freghar and Seneram standard security policies enforced on the device, together with keeping the CMS updated, should provide us with enough protection from attacks.

My personal choice would be an external WP-dedicated hosting solution but it comes at the price of a monthly fee which, albeit small, would still be an additional drain over community funds. In terms of performance, this would probably be the best solution but we do not expect a high workload for the web server.

I would still prefer, going with a self-hosting solution, to deploy the new website on a different machine than the tools server since it already hosts critical services to the community (i.e. TeamSpeak). This way we can isolate the service and protect other ones already deployed. We would need to balance out the allocated resources to this new VM in order to still have room in the tools server and having a decently fast website, although given the available resources it shouldn't be a big issue. @JamesTheClarke how much storage space does the website take up?

All in all, considering costs and performance I admit the best solution would be to host the new website on our infrastructure on a semi-dedicated VM.

Integrated Social Media Live Feeds

It would be great if we could introduce visually pleasing live feeds of our social media posts:

Reddit
Twitter
Youtube (individual channels of members who post somewhat frequently)

Switch Login Interface from Standard WP to BuddyPress

https://cnto-arma.com/login/

Currently, the Login Page still uses the Standard WP interface, which is fine during development but will eventually have to be replaced with a good-looking custom BuddyPress Login screen.

Automated WP Backup Solution

To avoid another complete loss of the WP Database we need an automated backup solution, which not only stores the DB, but the plugin and theme contents as well.

The backups should be stored not only on the tools server but on a seperate remote infrastructure.

Choose Backup Plugin
Setup Backup Plugin on WP Site
Test Plugin

Archive of Enjin Forums

The enjin forums cannot by default be exported to our new website. Enjin holds that data hostage to incentivize older communities to stay there.

But we will still rely on the content created between 2014 and 2020 as these records can be very valuable for future decision making. A time capsule for those forums has to be created which is only accessible to those who:

full members of the new website
have an enjin account on the old website

The drawback of that solution would be that any new Reservist+ joining through the website would have to create an enjin account to gain access to the old forums - this would need to be managed by Staff to assign tags etc. increasing manual workload. Or we could make the entire forums completely public but that would violate the assumption of members (including alumni) that anything they posted in Community, Branches or Administrative Forums would remain private.

Alternatively, we need to figure out a more advanced technique to export the enjin forum data and import it somehow to the new website.

Registration confirmation emails are not being sent out

After registration WP and the NAS are not communicating correctly to send out the registration email to complete activating the new site account.

The NAS does send out regular maintenance emails for other services I run on it thus I assume the fault is somewhere specifically within the WP setup.