View | Details | Raw Unified | Return to bug 15303
Collapse All | Expand All

(-)a/debian/scripts/koha-create (-2 / +3 lines)
Lines 738-749 then Link Here
738
738
739
    if [ "$USE_HTTPS" = "yes" ]; then
739
    if [ "$USE_HTTPS" = "yes" ]; then
740
        # Get letsencrypt certificates
740
        # Get letsencrypt certificates
741
        # TODO: fix path of letsencrypt
742
        $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain
741
        $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain
743
        # enable all ssl settings (apache won't start with these before certs are present)
742
        # enable all ssl settings (apache won't start with these before certs are present)
744
        sed -i "s:^\s*\(<.*IfDefine.*> #https\)$:# \1:" "/etc/apache2/sites-available/$name.conf"
743
        sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf"
745
        # change port from 80 to 443. (apache won't start if it is 443 without certs present)
744
        # change port from 80 to 443. (apache won't start if it is 443 without certs present)
746
        sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf"
745
        sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf"
746
        # enable redirect from http to https on port 80
747
        sed -i "s:^\s*#\(.*\)#nohttps$:\1:" "/etc/apache2/sites-available/$name.conf"
747
        # make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead
748
        # make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead
748
        touch $libdir/$instancename/letsencrypt.enabled
749
        touch $libdir/$instancename/letsencrypt.enabled
749
        # restart apache with working certs
750
        # restart apache with working certs
(-)a/debian/templates/apache-site-https.conf.in (-28 / +23 lines)
Lines 1-25 Link Here
1
# Koha instance __KOHASITE__ Apache config.
1
# Koha instance __KOHASITE__ Apache config.
2
2
3
<IfDefine DisabledOption> #https
3
# redirect http to https
4
<VirtualHost *:80>
4
#<VirtualHost *:80> #nohttps
5
  RewriteEngine On
5
#  RewriteEngine On #nohttps
6
  RewriteCond %{HTTPS} !=on
6
#  RewriteCond %{HTTPS} !=on #nohttps
7
  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
7
#  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] #nohttps
8
</VirtualHost>
8
#</VirtualHost> #nohttps
9
</IfDefine> #https
10
9
11
# OPAC
10
# OPAC
12
<VirtualHost *:80> #https
11
<VirtualHost *:80> #https
13
 <IfDefine DisabledOption> #https
12
#  SSLEngine on
14
   SSLEngine on
13
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
15
   SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
14
#  SSLCompression off
16
   SSLCompression off
15
#  SSLHonorCipherOrder on
17
   SSLHonorCipherOrder on
16
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-
18
   SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA"
17
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
19
   SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
18
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
20
   SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
19
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
21
   SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
22
 </IfDefine> #https
23
20
24
  <IfVersion >= 2.4>
21
  <IfVersion >= 2.4>
25
   Define instance "__KOHASITE__"
22
   Define instance "__KOHASITE__"
Lines 42-57 Link Here
42
39
43
# Intranet
40
# Intranet
44
<VirtualHost *:80> #https
41
<VirtualHost *:80> #https
45
 <IfDefine DisabledOption> #https
42
#  SSLEngine on
46
   SSLEngine on
43
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
47
   SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
44
#  SSLCompression off
48
   SSLCompression off
45
#  SSLHonorCipherOrder on
49
   SSLHonorCipherOrder on
46
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES
50
   SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA"
47
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
51
   SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
48
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
52
   SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
49
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
53
   SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
50
54
 </IfDefine> #https
55
  <IfVersion >= 2.4>
51
  <IfVersion >= 2.4>
56
   Define instance "__KOHASITE__"
52
   Define instance "__KOHASITE__"
57
  </IfVersion>
53
  </IfVersion>
58
- 

Return to bug 15303