Lines 71-76
Options:
Link Here
|
71 |
conjunction with --defaultsql and --populate-db. |
71 |
conjunction with --defaultsql and --populate-db. |
72 |
--upload-path dir Set a user defined upload_path. It defaults to |
72 |
--upload-path dir Set a user defined upload_path. It defaults to |
73 |
/var/lib/koha/<instance>/uploads |
73 |
/var/lib/koha/<instance>/uploads |
|
|
74 |
--letsencrypt Set up a https-only site with letsencrypt certificates |
74 |
--help,-h Show this help. |
75 |
--help,-h Show this help. |
75 |
|
76 |
|
76 |
Note: the instance name cannot be longer that 11 chars. |
77 |
Note: the instance name cannot be longer that 11 chars. |
Lines 192-197
EOM
Link Here
|
192 |
die |
193 |
die |
193 |
fi |
194 |
fi |
194 |
|
195 |
|
|
|
196 |
# Check that mod_ssl is installed and enabled. |
197 |
if [ "$CLO_LETSENCRYPT" = "yes" ]; then |
198 |
if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then |
199 |
cat 1>&2 <<EOM |
200 |
|
201 |
Koha requires mod_ssl to be enabled within Apache in order to run with --letsencrypt. |
202 |
Typically this can be enabled with: |
203 |
|
204 |
sudo a2enmod ssl |
205 |
EOM |
206 |
die |
207 |
fi |
208 |
fi |
209 |
|
195 |
} |
210 |
} |
196 |
|
211 |
|
197 |
set_biblios_indexing_mode() |
212 |
set_biblios_indexing_mode() |
Lines 311-316
enable_sru_server()
Link Here
|
311 |
fi |
326 |
fi |
312 |
} |
327 |
} |
313 |
|
328 |
|
|
|
329 |
check_letsencrypt() |
330 |
{ |
331 |
if [ $(dpkg-query -W -f='${Status}' letsencrypt 2>/dev/null | grep -c "ok installed") -eq 0 ]; then |
332 |
apt-cache show letsencrypt &>/dev/null |
333 |
if [ $? -eq 0 ]; then |
334 |
read -r -p "The letsencrypt package is not installed. Do it now? [y/N] " response |
335 |
if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then |
336 |
apt-get install -y letsencrypt |
337 |
else |
338 |
die "You have to install letsencrypt to use the --letsencrypt parameter." |
339 |
fi |
340 |
else |
341 |
echo "No installation candidate available for package letsencrypt." |
342 |
read -r -p "If you have a symlink from /usr/bin/letsencrypt to letsencrypt-auto, it should work. [y/N] " response |
343 |
if [[ ! $response =~ ^([yY][eE][sS]|[yY])$ ]]; then |
344 |
die "You have to install letsencrypt to use the --letsencrypt parameter." |
345 |
fi |
346 |
fi |
347 |
fi |
348 |
} |
349 |
|
350 |
letsencrypt_instance() |
351 |
{ |
352 |
# Get letsencrypt certificates |
353 |
letsencrypt --agree-tos --renew-by-default --webroot --staging certonly \ |
354 |
-w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain |
355 |
# enable all ssl settings (apache won't start with these before certs are present) |
356 |
sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" |
357 |
# change port from 80 to 443. (apache won't start if it is 443 without certs present) |
358 |
sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf" |
359 |
# enable redirect from http to https on port 80 |
360 |
sed -i "s:^\s*#\(.*\)#nohttps$:\1:" "/etc/apache2/sites-available/$name.conf" |
361 |
# make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead |
362 |
touch /var/lib/koha/$name/letsencrypt.enabled |
363 |
# restart apache with working certs |
364 |
service apache2 restart |
365 |
} |
366 |
|
314 |
# Set defaults and read config file, if it exists. |
367 |
# Set defaults and read config file, if it exists. |
315 |
DOMAIN="" |
368 |
DOMAIN="" |
316 |
OPACPORT="80" |
369 |
OPACPORT="80" |
Lines 354-359
END_BIBLIOS_RETRIEVAL_INFO=""
Link Here
|
354 |
START_AUTHORITIES_RETRIEVAL_INFO="" |
407 |
START_AUTHORITIES_RETRIEVAL_INFO="" |
355 |
END_AUTHORITIES_RETRIEVAL_INFO="" |
408 |
END_AUTHORITIES_RETRIEVAL_INFO="" |
356 |
|
409 |
|
|
|
410 |
APACHE_CONFIGFILE="" |
411 |
|
357 |
if [ -e /etc/koha/koha-sites.conf ] |
412 |
if [ -e /etc/koha/koha-sites.conf ] |
358 |
then |
413 |
then |
359 |
. /etc/koha/koha-sites.conf |
414 |
. /etc/koha/koha-sites.conf |
Lines 361-367
fi
Link Here
|
361 |
|
416 |
|
362 |
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) |
417 |
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) |
363 |
|
418 |
|
364 |
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \ |
419 |
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt, \ |
365 |
-n "$0" -- "$@"` |
420 |
-n "$0" -- "$@"` |
366 |
|
421 |
|
367 |
# Note the quotes around `$TEMP': they are essential! |
422 |
# Note the quotes around `$TEMP': they are essential! |
Lines 377-383
CLO_AUTHORITIES_INDEXING_MODE=""
Link Here
|
377 |
CLO_MEMCACHED_SERVERS="" |
432 |
CLO_MEMCACHED_SERVERS="" |
378 |
CLO_MEMCACHED_PREFIX="" |
433 |
CLO_MEMCACHED_PREFIX="" |
379 |
CLO_UPLOAD_PATH="" |
434 |
CLO_UPLOAD_PATH="" |
380 |
|
435 |
CLO_LETSENCRYPT="" |
381 |
|
436 |
|
382 |
while true ; do |
437 |
while true ; do |
383 |
case "$1" in |
438 |
case "$1" in |
Lines 419-424
while true ; do
Link Here
|
419 |
SRU_SERVER_PORT="$2" ; shift 2 ;; |
474 |
SRU_SERVER_PORT="$2" ; shift 2 ;; |
420 |
--upload-path) |
475 |
--upload-path) |
421 |
CLO_UPLOAD_PATH="$2" ; shift 2 ;; |
476 |
CLO_UPLOAD_PATH="$2" ; shift 2 ;; |
|
|
477 |
--letsencrypt) |
478 |
CLO_LETSENCRYPT="yes" ; shift ;; |
422 |
-h|--help) |
479 |
-h|--help) |
423 |
usage ; exit 0 ;; |
480 |
usage ; exit 0 ;; |
424 |
--) |
481 |
--) |
Lines 514-519
check_apache_config
Link Here
|
514 |
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN" |
571 |
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN" |
515 |
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN" |
572 |
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN" |
516 |
|
573 |
|
|
|
574 |
# Check everything is ok with letsencrypt, die otherwise |
575 |
check_letsencrypt |
517 |
|
576 |
|
518 |
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ] |
577 |
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ] |
519 |
then |
578 |
then |
Lines 598-605
FLUSH PRIVILEGES;
Link Here
|
598 |
eof |
657 |
eof |
599 |
fi #` |
658 |
fi #` |
600 |
|
659 |
|
|
|
660 |
if [ "$CLO_LETSENCRYPT" = "yes" ]; then |
661 |
APACHE_CONFIGFILE="apache-site-https.conf.in" |
662 |
else |
663 |
APACHE_CONFIGFILE="apache-site.conf.in" |
664 |
fi |
601 |
# Generate and install Apache site-available file and log dir. |
665 |
# Generate and install Apache site-available file and log dir. |
602 |
generate_config_file apache-site.conf.in \ |
666 |
generate_config_file $APACHE_CONFIGFILE \ |
603 |
"/etc/apache2/sites-available/$name.conf" |
667 |
"/etc/apache2/sites-available/$name.conf" |
604 |
mkdir "/var/log/koha/$name" |
668 |
mkdir "/var/log/koha/$name" |
605 |
chown "$username:$username" "/var/log/koha/$name" |
669 |
chown "$username:$username" "/var/log/koha/$name" |
Lines 708-713
then
Link Here
|
708 |
# Start Indexer daemon |
772 |
# Start Indexer daemon |
709 |
koha-indexer --start "$name" |
773 |
koha-indexer --start "$name" |
710 |
fi |
774 |
fi |
|
|
775 |
|
776 |
if [ "$CLO_LETSENCRYPT" = "yes" ]; then |
777 |
# Get letsencrypt certificates |
778 |
letsencrypt_instance |
779 |
fi |
711 |
fi |
780 |
fi |
712 |
|
781 |
|
713 |
|
782 |
|