Lines 72-77
Options:
Link Here
|
72 |
--upload-path dir Set a user defined upload_path. It defaults to |
72 |
--upload-path dir Set a user defined upload_path. It defaults to |
73 |
/var/lib/koha/<instance>/uploads |
73 |
/var/lib/koha/<instance>/uploads |
74 |
--letsencrypt Set up a https-only site with letsencrypt certificates |
74 |
--letsencrypt Set up a https-only site with letsencrypt certificates |
|
|
75 |
--tor Automatically set up a Tor hidden service for the OPAC |
75 |
--help,-h Show this help. |
76 |
--help,-h Show this help. |
76 |
|
77 |
|
77 |
Note: the instance name cannot be longer that 11 chars. |
78 |
Note: the instance name cannot be longer that 11 chars. |
Lines 377-382
letsencrypt_instance()
Link Here
|
377 |
echo -e "opacdomain=\"$opacdomain\"\nintradomain=\"$intradomain\"" > /var/lib/koha/$name/letsencrypt.enabled |
378 |
echo -e "opacdomain=\"$opacdomain\"\nintradomain=\"$intradomain\"" > /var/lib/koha/$name/letsencrypt.enabled |
378 |
# restart apache with working certs |
379 |
# restart apache with working certs |
379 |
service apache2 restart |
380 |
service apache2 restart |
|
|
381 |
|
382 |
tor_check_install() |
383 |
{ |
384 |
# Check if Tor is installed |
385 |
|
386 |
# Check if Tor is installed, otherwise do it now |
387 |
# Repeat for every instance. Do at the beginning so we can stop the installation if necessary. |
388 |
if [ $(dpkg-query -W -f='${Status}' tor 2>/dev/null | grep -c "ok installed") -eq 0 ]; then |
389 |
debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')" |
390 |
# Check if Tor repository for this version of GNU/Linux exists |
391 |
if [ $(curl -sI "http://deb.torproject.org/torproject.org/dists/$debrelease/" | grep -c "200 OK") -eq 0 ]; then |
392 |
die "Cannot find a Tor release for $debrelease in the official repository. Please install the 'tor' package manually to use the option --tor" |
393 |
else |
394 |
# Prompt before adding the official Tor repo and installing Tor |
395 |
read -r -p "Tor is not installed. Do you want Koha to automatically set up the Tor repository and install Tor? [y/N] " response |
396 |
if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]] |
397 |
then |
398 |
TORINSTALLATION="yes" |
399 |
else |
400 |
die "You need to install Tor to use the --tor option. Either accept or run koha-create without the --tor option." |
401 |
fi |
402 |
fi |
403 |
else |
404 |
if [ -e "/etc/tor/torrc-koha" ]; then |
405 |
TORINSTALLATION="previous" |
406 |
else |
407 |
TORINSTALLATION="manual" |
408 |
# Prompt to overwrite previous Tor config, otherwise stop installation |
409 |
read -r -p "Tor seems to be installed manually. Previous configuration file /etc/tor/torrc will be deleted! Continue? [y/N] " response |
410 |
if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]] |
411 |
then |
412 |
rm -f /etc/tor/torrc |
413 |
else |
414 |
die "Please move your old configuration file /etc/tor/torrc and run koha-create again." |
415 |
fi |
416 |
fi |
417 |
fi |
418 |
|
419 |
# Is a key already present in the folder? |
420 |
if [ $(tor_check_instance $name) -eq 1 ]; then |
421 |
# Prompt to re-use previous key |
422 |
toroldonion="$(tor_get_onion $name)" |
423 |
read -r -p "There is a previous .onion key in the hidden service folder for instance $name. Do you want to overwrite it? Choose no to re-use the address $toroldonion. [y/N] " response |
424 |
if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then |
425 |
rm -Rf /var/lib/tor/koha/$name/ |
426 |
toruseoldconfig="no" |
427 |
else |
428 |
toruseoldconfig="yes" |
429 |
fi |
430 |
|
431 |
fi |
432 |
} |
433 |
|
434 |
tor_check_instance() |
435 |
{ |
436 |
# Check if previous Tor hidden service folder exists and promt for re-use or deletion |
437 |
# Takes a Koha instance name as an argument |
438 |
if [ -e "/var/lib/tor/koha/$1/hidden_service/private_key" ]; then |
439 |
echo "1"; |
440 |
else |
441 |
echo "0" |
442 |
fi |
443 |
} |
444 |
|
445 |
tor_install() |
446 |
{ |
447 |
# Install Tor from the official repository. |
448 |
# Only done once… I guess. |
449 |
|
450 |
echo "Installing Tor…" |
451 |
debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')" |
452 |
# Check if Tor repository is already in /etc/apt/sources.list.* |
453 |
if [ $(grep -rl "^deb http://deb.torproject.org/torproject.org" "/etc/apt/sources.list" "/etc/apt/sources.list.d/") != "" ]; then |
454 |
echo "deb http://deb.torproject.org/torproject.org $debrelease main" | tee -a /etc/apt/sources.list.d/tor.list |
455 |
gpg --keyserver keys.gnupg.net --recv 886DDD89 |
456 |
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add - |
457 |
apt-get update |
458 |
fi |
459 |
apt-get install -y tor deb.torproject.org-keyring |
460 |
service tor stop |
461 |
# next: tor_config |
462 |
} |
463 |
|
464 |
tor_config() |
465 |
{ |
466 |
# Create Koha-specific Tor config, make backup of last config. |
467 |
# Called for every new instance |
468 |
|
469 |
# Check if /etc/tor/torrc-koha exists, if not create it now |
470 |
if [ ! -e "/etc/tor/torrc-koha" ]; then |
471 |
generate_config_file torrc.in \ |
472 |
"/etc/tor/torrc-koha" |
473 |
rm -f /etc/tor/torrc # just in case |
474 |
ln -s /etc/tor/torrc-koha /etc/tor/torrc |
475 |
chown -R debian-tor:debian-tor /etc/tor/ |
476 |
fi |
477 |
tor_instance |
478 |
} |
479 |
|
480 |
tor_instance() # FIXME there needs to be tor_remove in koha-remove to undo all this |
481 |
{ |
482 |
# Add config to Tor configuration file |
483 |
# Repeat for every instance. |
484 |
# FIXME should go to koha-tor or koha-functions? |
485 |
|
486 |
torconfig=`cat <<EOF |
487 |
|
488 |
# begin instance koha-$name |
489 |
HiddenServiceDir /var/lib/tor/koha/$name/hidden_service/ |
490 |
HiddenServicePort 80 127.0.0.1:80 |
491 |
# end instance koha-$name |
492 |
|
493 |
EOF` |
494 |
echo "$torconfig" >> /etc/tor/torrc-koha |
495 |
# Create instance-specific Tor folder. |
496 |
# We put this in /var/lib/tor/koha/ to keep it out of Koha backups and safe from koha-remove. |
497 |
# FIXME Would it be better to have it in the backups? |
498 |
# |
499 |
# Re-use old .onion if desired |
500 |
if [ "$toruseoldconfig" != "yes" ]; then |
501 |
mkdir -p /var/lib/tor/koha/$name |
502 |
fi |
503 |
chown -R debian-tor:debian-tor /var/lib/tor/koha/ |
504 |
# Start Tor with new settings |
505 |
service tor restart # needs to be done after apache for this instance is started, or hostname won't be created |
506 |
# Get .onion address # FIXME does this work instantly or should we wait a few seconds? |
507 |
onion="$(tor_get_onion $name)" |
508 |
torinfo=`cat <<EOF |
509 |
Your .onion address is $onion. |
510 |
If you already have another .onion address that you would like to re-use, |
511 |
stop the tor service, copy the key to /var/lib/tor/koha/$name/hidden_service/private_key, |
512 |
change the ServerAlias in /etc/apache2/sites/sites-available/$name.conf to your |
513 |
old .onion address, restart Apache and restart Tor. |
514 |
EOF` # FIXME Should this be done at the first check so we don't do all the installation? |
515 |
echo "$torinfo" |
516 |
# Write ServerAlias $onion to apache config and restart apache |
517 |
sed -i "s/__OPACTORHIDDENSERVICE__/$onion/g" "/etc/apache2/sites-available/$name.conf" |
518 |
sed -i "s:^\s*#\(.*\)#onion$: \1:" "/etc/apache2/sites-available/$name.conf" |
519 |
service apache2 reload |
520 |
} |
521 |
|
522 |
tor_get_onion() |
523 |
{ |
524 |
# Get .onion address of an instance |
525 |
# Repeat on demand. |
526 |
# FIXME should go to koha-tor or koha-functions? |
527 |
|
528 |
# This is useful for 'public' 'hidden' Koha OPACS. For security reasons, other |
529 |
# hidden services a library might run SHOULD NOT BE in /var/lib/tor/koha/ |
530 |
local myonion="$(cat /var/lib/tor/koha/$1/hidden_service/hostname)" |
531 |
echo $myonion |
380 |
} |
532 |
} |
381 |
|
533 |
|
382 |
# Set defaults and read config file, if it exists. |
534 |
# Set defaults and read config file, if it exists. |
Lines 425-430
END_AUTHORITIES_RETRIEVAL_INFO=""
Link Here
|
425 |
|
577 |
|
426 |
APACHE_CONFIGFILE="" |
578 |
APACHE_CONFIGFILE="" |
427 |
|
579 |
|
|
|
580 |
# Tor settings |
581 |
ENABLE_TOR_HIDDEN_SERVICE="no" |
582 |
TOR_INSTALLATION="no" |
583 |
|
428 |
if [ -e /etc/koha/koha-sites.conf ] |
584 |
if [ -e /etc/koha/koha-sites.conf ] |
429 |
then |
585 |
then |
430 |
. /etc/koha/koha-sites.conf |
586 |
. /etc/koha/koha-sites.conf |
Lines 432-438
fi
Link Here
|
432 |
|
588 |
|
433 |
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) |
589 |
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) |
434 |
|
590 |
|
435 |
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt, \ |
591 |
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt,tor, \ |
436 |
-n "$0" -- "$@"` |
592 |
-n "$0" -- "$@"` |
437 |
|
593 |
|
438 |
# Note the quotes around `$TEMP': they are essential! |
594 |
# Note the quotes around `$TEMP': they are essential! |
Lines 492-497
while true ; do
Link Here
|
492 |
CLO_UPLOAD_PATH="$2" ; shift 2 ;; |
648 |
CLO_UPLOAD_PATH="$2" ; shift 2 ;; |
493 |
--letsencrypt) |
649 |
--letsencrypt) |
494 |
CLO_LETSENCRYPT="yes" ; shift ;; |
650 |
CLO_LETSENCRYPT="yes" ; shift ;; |
|
|
651 |
--tor) |
652 |
ENABLE_TOR_HIDDEN_SERVICE="yes" ; shift ;; |
495 |
-h|--help) |
653 |
-h|--help) |
496 |
usage ; exit 0 ;; |
654 |
usage ; exit 0 ;; |
497 |
--) |
655 |
--) |
Lines 581-586
then
Link Here
|
581 |
die "This script must be run with root privileges." |
739 |
die "This script must be run with root privileges." |
582 |
fi |
740 |
fi |
583 |
|
741 |
|
|
|
742 |
# If --tor is used, but package 'tor' not installed, prompt for installation |
743 |
# If refused, we can stop cleanly here |
744 |
if [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then |
745 |
enable_tor_hidden_service |
746 |
fi |
747 |
|
584 |
# Check everything is ok with Apache, die otherwise |
748 |
# Check everything is ok with Apache, die otherwise |
585 |
check_apache_config |
749 |
check_apache_config |
586 |
|
750 |
|
Lines 799-810
then
Link Here
|
799 |
fi |
963 |
fi |
800 |
fi |
964 |
fi |
801 |
|
965 |
|
802 |
|
|
|
803 |
if [ "$op" = request ] |
966 |
if [ "$op" = request ] |
804 |
then |
967 |
then |
805 |
koha-disable "$name" |
968 |
koha-disable "$name" |
806 |
fi |
969 |
fi |
807 |
|
970 |
|
|
|
971 |
if [ "$op" = create ] && [ "$TORINSTALLATION" = "yes" ]; then |
972 |
tor_install |
973 |
fi |
974 |
|
975 |
if [ "$op" = create ] && [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then |
976 |
tor_config |
977 |
fi |
978 |
|
808 |
echo <<eoh |
979 |
echo <<eoh |
809 |
|
980 |
|
810 |
Email for this instance is disabled. When you're ready to enable it, use: |
981 |
Email for this instance is disabled. When you're ready to enable it, use: |