|
Lines 72-77
Options:
Link Here
|
| 72 |
--upload-path dir Set a user defined upload_path. It defaults to |
72 |
--upload-path dir Set a user defined upload_path. It defaults to |
| 73 |
/var/lib/koha/<instance>/uploads |
73 |
/var/lib/koha/<instance>/uploads |
| 74 |
--letsencrypt Set up a https-only site with letsencrypt certificates |
74 |
--letsencrypt Set up a https-only site with letsencrypt certificates |
|
|
75 |
--tor Automatically set up a Tor hidden service for the OPAC |
| 75 |
--help,-h Show this help. |
76 |
--help,-h Show this help. |
| 76 |
|
77 |
|
| 77 |
Note: the instance name cannot be longer that 11 chars. |
78 |
Note: the instance name cannot be longer that 11 chars. |
|
Lines 377-382
letsencrypt_instance()
Link Here
|
| 377 |
echo -e "opacdomain=\"$opacdomain\"\nintradomain=\"$intradomain\"" > /var/lib/koha/$name/letsencrypt.enabled |
378 |
echo -e "opacdomain=\"$opacdomain\"\nintradomain=\"$intradomain\"" > /var/lib/koha/$name/letsencrypt.enabled |
| 378 |
# restart apache with working certs |
379 |
# restart apache with working certs |
| 379 |
service apache2 restart |
380 |
service apache2 restart |
|
|
381 |
|
| 382 |
tor_check_install() |
| 383 |
{ |
| 384 |
# Check if Tor is installed |
| 385 |
|
| 386 |
# Check if Tor is installed, otherwise do it now |
| 387 |
# Repeat for every instance. Do at the beginning so we can stop the installation if necessary. |
| 388 |
if [ $(dpkg-query -W -f='${Status}' tor 2>/dev/null | grep -c "ok installed") -eq 0 ]; then |
| 389 |
debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')" |
| 390 |
# Check if Tor repository for this version of GNU/Linux exists |
| 391 |
if [ $(curl -sI "http://deb.torproject.org/torproject.org/dists/$debrelease/" | grep -c "200 OK") -eq 0 ]; then |
| 392 |
die "Cannot find a Tor release for $debrelease in the official repository. Please install the 'tor' package manually to use the option --tor" |
| 393 |
else |
| 394 |
# Prompt before adding the official Tor repo and installing Tor |
| 395 |
read -r -p "Tor is not installed. Do you want Koha to automatically set up the Tor repository and install Tor? [y/N] " response |
| 396 |
if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]] |
| 397 |
then |
| 398 |
TORINSTALLATION="yes" |
| 399 |
else |
| 400 |
die "You need to install Tor to use the --tor option. Either accept or run koha-create without the --tor option." |
| 401 |
fi |
| 402 |
fi |
| 403 |
else |
| 404 |
if [ -e "/etc/tor/torrc-koha" ]; then |
| 405 |
TORINSTALLATION="previous" |
| 406 |
else |
| 407 |
TORINSTALLATION="manual" |
| 408 |
# Prompt to overwrite previous Tor config, otherwise stop installation |
| 409 |
read -r -p "Tor seems to be installed manually. Previous configuration file /etc/tor/torrc will be deleted! Continue? [y/N] " response |
| 410 |
if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]] |
| 411 |
then |
| 412 |
rm -f /etc/tor/torrc |
| 413 |
else |
| 414 |
die "Please move your old configuration file /etc/tor/torrc and run koha-create again." |
| 415 |
fi |
| 416 |
fi |
| 417 |
fi |
| 418 |
|
| 419 |
# Is a key already present in the folder? |
| 420 |
if [ $(tor_check_instance $name) -eq 1 ]; then |
| 421 |
# Prompt to re-use previous key |
| 422 |
toroldonion="$(tor_get_onion $name)" |
| 423 |
read -r -p "There is a previous .onion key in the hidden service folder for instance $name. Do you want to overwrite it? Choose no to re-use the address $toroldonion. [y/N] " response |
| 424 |
if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then |
| 425 |
rm -Rf /var/lib/tor/koha/$name/ |
| 426 |
toruseoldconfig="no" |
| 427 |
else |
| 428 |
toruseoldconfig="yes" |
| 429 |
fi |
| 430 |
|
| 431 |
fi |
| 432 |
} |
| 433 |
|
| 434 |
tor_check_instance() |
| 435 |
{ |
| 436 |
# Check if previous Tor hidden service folder exists and promt for re-use or deletion |
| 437 |
# Takes a Koha instance name as an argument |
| 438 |
if [ -e "/var/lib/tor/koha/$1/hidden_service/private_key" ]; then |
| 439 |
echo "1"; |
| 440 |
else |
| 441 |
echo "0" |
| 442 |
fi |
| 443 |
} |
| 444 |
|
| 445 |
tor_install() |
| 446 |
{ |
| 447 |
# Install Tor from the official repository. |
| 448 |
# Only done once… I guess. |
| 449 |
|
| 450 |
echo "Installing Tor…" |
| 451 |
debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')" |
| 452 |
# Check if Tor repository is already in /etc/apt/sources.list.* |
| 453 |
if [ $(grep -rl "^deb http://deb.torproject.org/torproject.org" "/etc/apt/sources.list" "/etc/apt/sources.list.d/") != "" ]; then |
| 454 |
echo "deb http://deb.torproject.org/torproject.org $debrelease main" | tee -a /etc/apt/sources.list.d/tor.list |
| 455 |
gpg --keyserver keys.gnupg.net --recv 886DDD89 |
| 456 |
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - |
| 457 |
apt-get update |
| 458 |
fi |
| 459 |
apt-get install -y tor deb.torproject.org-keyring |
| 460 |
service tor stop |
| 461 |
# next: tor_config |
| 462 |
} |
| 463 |
|
| 464 |
tor_config() |
| 465 |
{ |
| 466 |
# Create Koha-specific Tor config, make backup of last config. |
| 467 |
# Called for every new instance |
| 468 |
|
| 469 |
# Check if /etc/tor/torrc-koha exists, if not create it now |
| 470 |
if [ ! -e "/etc/tor/torrc-koha" ]; then |
| 471 |
generate_config_file torrc.in \ |
| 472 |
"/etc/tor/torrc-koha" |
| 473 |
rm -f /etc/tor/torrc # just in case |
| 474 |
ln -s /etc/tor/torrc-koha /etc/tor/torrc |
| 475 |
chown -R debian-tor:debian-tor /etc/tor/ |
| 476 |
fi |
| 477 |
tor_instance |
| 478 |
} |
| 479 |
|
| 480 |
tor_instance() # FIXME there needs to be tor_remove in koha-remove to undo all this |
| 481 |
{ |
| 482 |
# Add config to Tor configuration file |
| 483 |
# Repeat for every instance. |
| 484 |
# FIXME should go to koha-tor or koha-functions? |
| 485 |
|
| 486 |
torconfig=`cat <<EOF |
| 487 |
|
| 488 |
# begin instance koha-$name |
| 489 |
HiddenServiceDir /var/lib/tor/koha/$name/hidden_service/ |
| 490 |
HiddenServicePort 80 127.0.0.1:80 |
| 491 |
# end instance koha-$name |
| 492 |
|
| 493 |
EOF` |
| 494 |
echo "$torconfig" >> /etc/tor/torrc-koha |
| 495 |
# Create instance-specific Tor folder. |
| 496 |
# We put this in /var/lib/tor/koha/ to keep it out of Koha backups and safe from koha-remove. |
| 497 |
# FIXME Would it be better to have it in the backups? |
| 498 |
# |
| 499 |
# Re-use old .onion if desired |
| 500 |
if [ "$toruseoldconfig" != "yes" ]; then |
| 501 |
mkdir -p /var/lib/tor/koha/$name |
| 502 |
fi |
| 503 |
chown -R debian-tor:debian-tor /var/lib/tor/koha/ |
| 504 |
# Start Tor with new settings |
| 505 |
service tor restart # needs to be done after apache for this instance is started, or hostname won't be created |
| 506 |
# Get .onion address # FIXME does this work instantly or should we wait a few seconds? |
| 507 |
onion="$(tor_get_onion $name)" |
| 508 |
torinfo=`cat <<EOF |
| 509 |
Your .onion address is $onion. |
| 510 |
If you already have another .onion address that you would like to re-use, |
| 511 |
stop the tor service, copy the key to /var/lib/tor/koha/$name/hidden_service/private_key, |
| 512 |
change the ServerAlias in /etc/apache2/sites/sites-available/$name.conf to your |
| 513 |
old .onion address, restart Apache and restart Tor. |
| 514 |
EOF` # FIXME Should this be done at the first check so we don't do all the installation? |
| 515 |
echo "$torinfo" |
| 516 |
# Write ServerAlias $onion to apache config and restart apache |
| 517 |
sed -i "s/__OPACTORHIDDENSERVICE__/$onion/g" "/etc/apache2/sites-available/$name.conf" |
| 518 |
sed -i "s:^\s*#\(.*\)#onion$: \1:" "/etc/apache2/sites-available/$name.conf" |
| 519 |
service apache2 reload |
| 520 |
} |
| 521 |
|
| 522 |
tor_get_onion() |
| 523 |
{ |
| 524 |
# Get .onion address of an instance |
| 525 |
# Repeat on demand. |
| 526 |
# FIXME should go to koha-tor or koha-functions? |
| 527 |
|
| 528 |
# This is useful for 'public' 'hidden' Koha OPACS. For security reasons, other |
| 529 |
# hidden services a library might run SHOULD NOT BE in /var/lib/tor/koha/ |
| 530 |
local myonion="$(cat /var/lib/tor/koha/$1/hidden_service/hostname)" |
| 531 |
echo $myonion |
| 380 |
} |
532 |
} |
| 381 |
|
533 |
|
| 382 |
# Set defaults and read config file, if it exists. |
534 |
# Set defaults and read config file, if it exists. |
|
Lines 425-430
END_AUTHORITIES_RETRIEVAL_INFO=""
Link Here
|
| 425 |
|
577 |
|
| 426 |
APACHE_CONFIGFILE="" |
578 |
APACHE_CONFIGFILE="" |
| 427 |
|
579 |
|
|
|
580 |
# Tor settings |
| 581 |
ENABLE_TOR_HIDDEN_SERVICE="no" |
| 582 |
TOR_INSTALLATION="no" |
| 583 |
|
| 428 |
if [ -e /etc/koha/koha-sites.conf ] |
584 |
if [ -e /etc/koha/koha-sites.conf ] |
| 429 |
then |
585 |
then |
| 430 |
. /etc/koha/koha-sites.conf |
586 |
. /etc/koha/koha-sites.conf |
|
Lines 432-438
fi
Link Here
|
| 432 |
|
588 |
|
| 433 |
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) |
589 |
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) |
| 434 |
|
590 |
|
| 435 |
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt, \ |
591 |
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt,tor, \ |
| 436 |
-n "$0" -- "$@"` |
592 |
-n "$0" -- "$@"` |
| 437 |
|
593 |
|
| 438 |
# Note the quotes around `$TEMP': they are essential! |
594 |
# Note the quotes around `$TEMP': they are essential! |
|
Lines 492-497
while true ; do
Link Here
|
| 492 |
CLO_UPLOAD_PATH="$2" ; shift 2 ;; |
648 |
CLO_UPLOAD_PATH="$2" ; shift 2 ;; |
| 493 |
--letsencrypt) |
649 |
--letsencrypt) |
| 494 |
CLO_LETSENCRYPT="yes" ; shift ;; |
650 |
CLO_LETSENCRYPT="yes" ; shift ;; |
|
|
651 |
--tor) |
| 652 |
ENABLE_TOR_HIDDEN_SERVICE="yes" ; shift ;; |
| 495 |
-h|--help) |
653 |
-h|--help) |
| 496 |
usage ; exit 0 ;; |
654 |
usage ; exit 0 ;; |
| 497 |
--) |
655 |
--) |
|
Lines 581-586
then
Link Here
|
| 581 |
die "This script must be run with root privileges." |
739 |
die "This script must be run with root privileges." |
| 582 |
fi |
740 |
fi |
| 583 |
|
741 |
|
|
|
742 |
# If --tor is used, but package 'tor' not installed, prompt for installation |
| 743 |
# If refused, we can stop cleanly here |
| 744 |
if [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then |
| 745 |
enable_tor_hidden_service |
| 746 |
fi |
| 747 |
|
| 584 |
# Check everything is ok with Apache, die otherwise |
748 |
# Check everything is ok with Apache, die otherwise |
| 585 |
check_apache_config |
749 |
check_apache_config |
| 586 |
|
750 |
|
|
Lines 799-810
then
Link Here
|
| 799 |
fi |
963 |
fi |
| 800 |
fi |
964 |
fi |
| 801 |
|
965 |
|
| 802 |
|
|
|
| 803 |
if [ "$op" = request ] |
966 |
if [ "$op" = request ] |
| 804 |
then |
967 |
then |
| 805 |
koha-disable "$name" |
968 |
koha-disable "$name" |
| 806 |
fi |
969 |
fi |
| 807 |
|
970 |
|
|
|
971 |
if [ "$op" = create ] && [ "$TORINSTALLATION" = "yes" ]; then |
| 972 |
tor_install |
| 973 |
fi |
| 974 |
|
| 975 |
if [ "$op" = create ] && [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then |
| 976 |
tor_config |
| 977 |
fi |
| 978 |
|
| 808 |
echo <<eoh |
979 |
echo <<eoh |
| 809 |
|
980 |
|
| 810 |
Email for this instance is disabled. When you're ready to enable it, use: |
981 |
Email for this instance is disabled. When you're ready to enable it, use: |