From c5a7a6ec20436852b1cfa5d7559b1db0a9ecaa9e Mon Sep 17 00:00:00 2001 From: Mirko Tietgen Date: Fri, 4 Dec 2015 01:11:17 +0100 Subject: [PATCH] Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) Test plan: - build a debian package with patch applied - checkout letsencrypt on the machine where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - use apache mod_ssl sudo a2enmod ssl - make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet - install koha with your new package - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt - wait until setup is finished, check that you got a working OPAC and staff client with certificates make sure to use https:// to open both sites Todo - use letsencrypt default path in debian when we know where that is - enable redirect from port 80 to https in apache config --- debian/docs/koha-create.xml | 17 +++++++ debian/scripts/koha-create | 46 +++++++++++++++++-- debian/templates/apache-site-https.conf.in | 68 ++++++++++++++++++++++++++++ 3 files changed, 128 insertions(+), 3 deletions(-) create mode 100644 debian/templates/apache-site-https.conf.in diff --git a/debian/docs/koha-create.xml b/debian/docs/koha-create.xml index 92785ac..ede6561 100644 --- a/debian/docs/koha-create.xml +++ b/debian/docs/koha-create.xml @@ -40,6 +40,8 @@ port directory + + directory | instancename @@ -177,6 +179,21 @@ + + + Set up a https-only website + + + + + + + Specify the where letsencrypt-auto lives + It defaults to /path/to/letsencrypt. + + + + , Print usage information. diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create index a36f7e3..6c8455c 100755 --- a/debian/scripts/koha-create +++ b/debian/scripts/koha-create @@ -71,6 +71,8 @@ Options: conjunction with --defaultsql and --populate-db. --upload-path dir Set a user defined upload_path. It defaults to /var/lib/koha//uploads + --force-https Set up a https-only site with letsencrypt certificates + --letsencrypt Path to the letsencrypt folder --help,-h Show this help. Note: the instance name cannot be longer that 11 chars. @@ -192,6 +194,20 @@ EOM die fi + # Check that mod_ssl is installed and enabled. + if [ "$USE_HTTPS" = "yes" ]; then + if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then + cat 1>&2 < #https$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # TODO: enable forward from 80 to https + # restart apache with working certs + service apache2 restart + fi fi diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in new file mode 100644 index 0000000..dceca7c --- /dev/null +++ b/debian/templates/apache-site-https.conf.in @@ -0,0 +1,68 @@ +# Koha instance __KOHASITE__ Apache config. + +# #nohttps +# RewriteEngine On +# RewriteCond %{HTTPS} !=on +# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] +# + + +# OPAC + #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-opac-plack.conf + Include /etc/koha/apache-shared-opac.conf + + ServerName __OPACSERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/opac-error.log +# TransferLog /var/log/koha/__KOHASITE__/opac-access.log +# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log + + +# Intranet + #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-intranet-plack.conf + Include /etc/koha/apache-shared-intranet.conf + + ServerName __INTRASERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/intranet-error.log +# TransferLog /var/log/koha/__KOHASITE__/intranet-access.log +# RewriteLog /var/log/koha/__KOHASITE__/intranet-rewrite.log + -- 1.7.10.4