Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run Scan×
FREEDOM251

Freedom251 › Blog › DevOps

How to Create a Puppet Module to Automate WordPress Installation

By Freedom251 Team · · 13 min read

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The reliable pattern is to make Puppet declare the entire WordPress stack—runtime packages, web server, database, document root, WP-CLI, configuration, and service state—then let guarded WP-CLI commands perform the one-time application install. Keep prerequisites separate from application tasks, pin versions and checksums, pass secrets through protected data, and add explicit ordering so a second Puppet run converges without downloading or reinstalling WordPress.

What the module should automate

A production-ready module should turn a fresh host into a configured WordPress site and make the result repeatable. That means declaring directories, packages, users, ownership, permissions, services, virtual-host configuration, database objects, WordPress files, wp-config.php, and the initial administrator. Puppet remains responsible for desired state; WP-CLI is used for operations that are easier to express as WordPress commands.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Decide the ownership boundary before writing manifests. A single module can own the whole stack, but a composable design is usually easier to maintain: companion modules provide Apache or NGINX, PHP-FPM, a system account, MariaDB or MySQL, and archive or repository support, while the WordPress module consumes those resources. Do not silently assume that a web server, PHP, database, database user, or virtual host already exists. Make each assumption a parameter or a documented dependency.

Choose a supported platform baseline

WordPress.org currently asks hosts to support PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, HTTPS, and Apache or NGINX. Older combinations such as PHP 7.4 or MySQL 5.5.5 may still run some releases, but they are end-of-life and should not be selected for a new deployment.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Layer Recommended baseline What Puppet should declare
PHP 8.3 or newer for the WordPress host PHP runtime, CLI, required extensions, and PHP-FPM or the selected Apache integration
Database MariaDB 10.11+ or MySQL 8.0+ Server availability, database, application user, character set, and credentials
Web server Apache or NGINX Package, virtual host, document root, PHP hand-off, HTTPS configuration, and service
Transport HTTPS TLS certificate and key supplied by an approved certificate workflow, not embedded in the module
WP-CLI PHP 7.2.24 or newer is required by WP-CLI; use the host’s newer PHP baseline Phar file, checksum or signature verification, executable mode, and PATH location
WordPress source A pinned release for repeatable infrastructure Version, locale, download path, and a guard proving that core is already present

Pinning WordPress and WP-CLI gives predictable convergence and lets you promote the same artifact through environments. A policy that always follows the latest release reduces the time to receive upstream fixes but turns an ordinary Puppet run into an implicit upgrade. If you choose latest, document that behavior and test it as an upgrade workflow rather than treating it as an installation detail.

Use the standard module layout

Keep classes and defined types in manifests/, static files in files/, and generated configuration in templates/. Puppet’s module conventions expect one class or defined type per manifest file. Render EPP or ERB templates through a file resource.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
wordpress_install/
├── manifests/
│   ├── init.pp
│   ├── params.pp
│   ├── prerequisites.pp
│   ├── wp_cli.pp
│   ├── database.pp
│   ├── config.pp
│   └── install.pp
├── templates/
│   ├── wp-config.php.epp
│   └── vhost.conf.epp
├── files/
├── metadata.json
├── README.md
└── .pmtignore

init.pp should compose the other classes and expose the public parameters. Keep operating-system defaults in params.pp or typed parameter defaults, but do not hide site-specific values there. A class should fail clearly when a required value, such as a database password or site URL, has not been supplied.

Define a typed, explicit contract

Typed parameters make bad catalog data fail at compile time instead of halfway through an installation. A practical interface includes the following values.

Parameter Purpose Validation or security rule
site_url Canonical URL passed to WP-CLI and the web server Require an HTTPS URL in production; do not append a path that differs from the document root
site_title Initial WordPress title Use a non-empty string; changing it later should be an explicit content-management action
docroot Absolute path containing WordPress Require an absolute path and manage its parent directory
owner and group Unix ownership for files and runtime writes Use the account that the web service actually runs as; avoid world-writable permissions
wp_version and wp_locale WordPress release and language Pin the release; validate the locale format used by your mirror or download policy
wp_cli_version or source checksum Reproducible WP-CLI binary Verify a trusted checksum or signature before installing it
db_host, db_name, db_user Database connection identity Quote values correctly in generated PHP and SQL; do not infer them from the site title
db_password Database credential Declare it as a Puppet Sensitive value or retrieve it from a secret backend
admin_user, admin_email Initial WordPress administrator Validate the email and reserve the username; avoid predictable names for internet-facing sites
admin_password Initial administrator credential Keep it out of manifests, command arguments, reports, logs, and process listings

Also decide whether the module creates the operating-system account, database and user, and virtual host. If it does not, document the required resources and use Puppet relationships to ensure they exist before application installation.

Compose prerequisites before application work

The prerequisite class should install packages, create the account and document root, and ensure the selected web and database services are available. It should not download WordPress or create an administrator. Separating those concerns lets you reuse the stack for a second site and makes failures easier to diagnose.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Directories, account, and permissions

Declare the document root as a directory with the intended owner and group. Create only the subdirectories that need runtime writes, such as an uploads directory, and keep core files owned by the deployment account where possible. A blanket recursive mode of 0777 is not an acceptable shortcut. After installation, verify that the web service can read core files and write only the paths your update and upload policy allows.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Web server and PHP integration

For Apache, render a virtual host that points to the document root and passes PHP requests to the selected PHP handler. For NGINX, render the server block and PHP-FPM upstream. Include HTTPS and the WordPress front-controller rule appropriate to that server. Keep TLS certificate management outside the WordPress class unless this module explicitly owns it.

Database objects

Create the database and application user before running wp core install. Restrict the user to the required database and host pattern. If the database is remote, make the host and port explicit and ensure network access is established before the install command. Do not put a database password in a resource title or an unprotected template variable.

Install WP-CLI reproducibly

The WP-CLI project recommends downloading the Phar build, optionally verifying its signature or checksum, marking it executable, and placing it on the PATH. Do that once through a managed file resource rather than downloading an unreviewed moving target on every run.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
file { '/usr/local/bin/wp':
  ensure   => file,
  mode     => '0755',
  source   => $wp_cli_source,
  checksum => $wp_cli_checksum,
}

Use a package, file source, or internal artifact repository that your operating system supports. If you download during convergence, pin both the URL and digest and make the download resource itself idempotent. Run /usr/local/bin/wp --info as the deployment user during validation; it should report a compatible PHP runtime and the expected WP-CLI version.

Model the four WP-CLI installation stages

The documented workflow is: download WordPress, generate configuration, create the database, and run the core installation. Puppet should represent each stage as a resource with an explicit relationship to the previous stage.

1. Download core files

wp core download accepts a path, locale, and version. Guard it with a file that only exists in a valid WordPress tree, such as wp-includes/version.php, rather than a generic directory that might have been created by another process.

exec { 'wp core download':
  command => "/usr/local/bin/wp core download --path=${docroot} --version=${wp_version} --locale=${wp_locale}",
  creates => "${docroot}/wp-includes/version.php",
  user    => $owner,
  require => [File[$docroot], File['/usr/local/bin/wp']],
}

If the path contains an existing partial download, fail and investigate instead of deleting it automatically. A destructive cleanup can erase user content or conceal a failed deployment.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

2. Generate wp-config.php

Render the configuration only after core files exist. The template should contain the database name, user, host, table prefix, authentication salts, and debug policy. Generate salts from a trusted secret source or inject values created by your secret-management process; do not commit static salts to the module repository.

file { "${docroot}/wp-config.php":
  ensure  => file,
  owner   => $owner,
  group   => $group,
  mode    => '0640',
  content => epp('wordpress_install/wp-config.php.epp', $config_data),
  require => Exec['wp core download'],
}

Set the mode so the web process can read the file while unrelated users cannot. If your PHP integration requires the web-service account to own the file, make that an explicit parameter and accept the operational trade-off.

3. Create or verify the database

Create the database and user through a database resource or a dedicated database module. Then verify connectivity with the same host, user, and database values that will be written to wp-config.php. A successful database resource does not prove that network policy, DNS, TLS, or credentials are correct, so a preflight check can provide a clearer error before WordPress starts.

4. Run wp core install

wp core install creates the WordPress tables and performs the standard installation using the URL, title, and administrator details supplied. Guard it with a state marker created only after success, or with a wrapper that runs wp core is-installed and exits successfully when the site is already installed.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
exec { 'wp core install':
  command => "/usr/local/bin/wp core install --path=${docroot} --url=${site_url} --title=${site_title} --admin_user=${admin_user} --admin_email=${admin_email} --skip-email",
  creates => "${docroot}/.wordpress-installed",
  user    => $owner,
  require => [File["${docroot}/wp-config.php"], Database[$db_name]],
  notify  => Service[$web_service],
}

The example omits the administrator password deliberately. Passing it as a command-line argument can expose it through process listings, shell history, Puppet reports, or debug logs. The official WP-CLI example demonstrates redirecting password input from a file to avoid Bash history. In production, prefer a protected temporary file with mode 0600, a secret backend, or another input method supported by your WP-CLI version. Remove the temporary file only after the command succeeds or fails in a controlled cleanup step.

If you use a marker, create it in a wrapper after checking the exit status; do not declare the marker as an unconditional file resource. An unconditional marker would make Puppet believe installation succeeded even when the command failed.

Make every rerun converge safely

Puppet’s value is repeated convergence. One-time commands need guards, and mutable configuration needs a clear ownership policy.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
  • Use creates for downloads and installation markers when the presence of the file proves completion.
  • Use onlyif or unless for checks such as wp core is-installed when a marker could be removed or copied incorrectly.
  • Require the document root and WP-CLI binary before downloading core.
  • Require core and the generated configuration before installing tables.
  • Require the database resource before invoking WordPress installation.
  • Notify the web service only when its configuration file changes; do not restart it after every Puppet run.
  • Keep uploads and user-generated content outside any resource that could replace the whole document root.
  • Separate installation from upgrades. A changed wp_version should invoke a tested upgrade procedure, not rerun the initial administrator creation.

For a stronger guard, create a wrapper script managed by Puppet. It can run wp core is-installed --path=..., exit with status zero when already installed, and otherwise execute the password-safe installation sequence. Puppet then manages the wrapper and invokes it with unless or onlyif conditions that are easy to test.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep secrets out of catalogs and processes

Mark database and administrator passwords as Sensitive values and ensure reports do not reveal their contents. Do not interpolate them into command arguments, resource titles, shell scripts stored world-readably, or ordinary logs. A protected temporary file should be owned by the deployment user, mode 0600, located on a filesystem with appropriate retention controls, and removed after use.

Remember that wp-config.php necessarily contains database credentials. Protect it with restrictive ownership and mode, exclude it from web-server directory listings, and include it in the host’s backup and rotation policy. Rotating the database password requires a coordinated update of the database user and configuration file, followed by a connectivity check.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Choose a deployment workflow

Workflow When it fits Operational rule
Puppet agent and server Teams managing multiple hosts and environments Promote module and dependency versions through a control repository; review catalog changes before rollout
Control repository with Puppetfile and r10k-style deployment Code-managed infrastructure with repeatable dependency resolution Pin module versions and deploy the lock state rather than installing dependencies ad hoc on a host
puppet apply Small standalone environments or a bootstrap phase Keep manifests and module versions under source control and run the same validation checks as a server-managed deployment

Puppet can install a module and its dependencies from the Forge or another repository, but code-managed environments should use their Puppetfile workflow. Mixing ad hoc installation with a locked control repository makes it difficult to reproduce the catalog that created a host.

Test the module before publishing

Static and catalog checks

  • Run Puppet parser and lint checks on every manifest.
  • Compile catalogs for each supported operating system and assert that package names, paths, providers, and service names resolve.
  • Check that sensitive parameters remain sensitive in reports and that no password appears in a command string.
  • Verify dependency metadata and version constraints before building the module.

Convergence checks

  1. Apply the module to a clean host and confirm that the expected PHP, web-server, database, and WP-CLI versions are installed.
  2. Open the site over HTTPS and verify that the canonical URL, title, locale, and administrator account are correct.
  3. Run Puppet again without changing parameters. The second run should report no download or installation changes.
  4. Change a virtual-host setting and confirm that only the intended configuration resource and service notification change.
  5. Interrupt the installation between stages, repair the failed prerequisite, and rerun. The module should resume without deleting existing uploads or credentials.

Application checks

Use wp core is-installed, wp option get siteurl, and a database query or health check to confirm that the files, configuration, and tables agree. Test a front-page request, a login request, and a write to the uploads path under the same user identity used by the web service.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Package and publish correctly

Keep metadata.json accurate, including supported Puppet and operating-system versions and dependency constraints. Use .pmtignore or .pdkignore to exclude tests, build output, logs, editor files, local credentials, and other development-only material. Remove symlinks before building: Puppet publishing guidance treats symlinks as unsupported and they can cause module builds to fail. Build the package, inspect its contents, and test installation from the built artifact rather than only from the working tree.

Common failures and fixes

WP-CLI reports an unsupported PHP version

Check the PHP binary used by the wp executable, not only the PHP-FPM version serving HTTP. Install or select a compatible CLI binary and ensure the Puppet-managed PATH points to it. WP-CLI requires PHP 7.2.24 or later, while a new WordPress host should target PHP 8.3 or newer.

The download repeats on every run

The creates path may be wrong, the command may be running under a different document root, or the download is failing before the marker is written. Inspect the actual path and exit status, then choose a marker that proves a complete core tree rather than merely an existing directory.

wp core install says the site is already installed

The guard and the real site state disagree. Query wp core is-installed using the same path and user as the install command, remove only a demonstrably stale marker, and rerun. Never drop tables automatically as a repair step.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Database authentication fails

Compare the host, port, database name, username, password, and allowed source host in the database resource with the generated wp-config.php. Check DNS, firewall rules, TLS requirements, and whether the PHP process can reach the remote server. Rotate the credential through the secret workflow rather than editing the file manually.

The site returns a 404 for pretty URLs

Confirm that the Apache rewrite rules or NGINX front-controller configuration were rendered for the correct document root and enabled site. Reload the web service only after the configuration validates, then test both the home page and a non-root permalink.

Files are writable by the wrong account

Inspect ownership on core files, wp-content, and uploads. Align the module’s owner and group parameters with the actual PHP execution user, and grant write access only to paths that require it. Do not solve a mismatch by making the entire tree world-writable.

Decide the main implementation trade-offs

Decision Option A Option B Selection guidance
Ownership boundary One module owns the complete stack Compose web, account, database, archive, and WordPress modules Choose one owner per resource; composition usually reduces hidden assumptions
Web server Apache NGINX Use the platform’s supported PHP integration and the team’s established virtual-host conventions; both are recommended WordPress choices
Database MariaDB MySQL Use the supported version already operated reliably in your platform; meet the WordPress minimum version
Source policy Latest release Pinned release and checksum Latest improves patch currency; pinning improves repeatability and rollback planning
Secret delivery Protected file or secret backend Command-line argument Prefer the first option because process listings, shell history, and reports can expose arguments
Execution mode Agent/server control repository puppet apply Match the environment, but keep versions and dependencies under source control in either case

A practical build order

  1. Write the parameter contract and decide which resources the module owns.
  2. Create the standard directory structure and metadata before adding application logic.
  3. Declare the account, document root, PHP packages, web server, database prerequisites, and service resources.
  4. Install and verify a pinned WP-CLI Phar with a checksum or signature.
  5. Download a pinned WordPress release with a completion guard.
  6. Render a protected wp-config.php from sensitive data and generated salts.
  7. Create or verify the database and application user.
  8. Run a guarded, password-safe wp core install command.
  9. Apply ownership and least-privilege permissions, then notify the web service only for relevant configuration changes.
  10. Test a clean run, a second no-op run, an interrupted run, and a controlled version upgrade.
  11. Build the package, inspect ignored files and symlinks, and publish only the tested artifact.

Following this order gives Puppet a clear dependency graph and gives operators a safe recovery point after each stage. The resulting module can create a new site consistently while preserving the desired-state behavior that makes routine Puppet runs uneventful.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

DevOpsinfrastructure as codeMariaDBMySQLPHPPuppetWordPressWP-CLI

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.