Bugzilla – Attachment 45402 Details for
Bug 15303
Letsencrypt option for Debian package installations
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 15303 Letsencrypt option for Debian package installations
Bug-15303-Letsencrypt-option-for-Debian-package-in.patch (text/plain), 6.78 KB, created by
Mirko Tietgen
on 2015-12-04 01:00:54 UTC
(
hide
)
Description:
Bug 15303 Letsencrypt option for Debian package installations
Filename:
MIME Type:
Creator:
Mirko Tietgen
Created:
2015-12-04 01:00:54 UTC
Size:
6.78 KB
patch
obsolete
>From 5bb46b36c9eeda17f71fccaeaa17cfbf53d8423f Mon Sep 17 00:00:00 2001 >From: Mirko Tietgen <mirko@abunchofthings.net> >Date: Fri, 4 Dec 2015 01:11:17 +0100 >Subject: [PATCH] Bug 15303 Letsencrypt option for Debian package > installations > >Apache file for https only setups with automatic certificate >generation via letsencrypt. We need a workiung web server for >the letsencrypt magic, but we can't start on 443 without certs. >So we start on 80, get the certs, switch to 443 and restart >apache. 80 gets forwarded to https. > >New option koha-create --force-https >- generates letsencrypt certificates >- sets up a https-only website >- redirects 80 to https (not yet) >--- > debian/scripts/koha-create | 29 +++++++++++- > debian/templates/apache-site-https.conf.in | 68 ++++++++++++++++++++++++++++ > 2 files changed, 95 insertions(+), 2 deletions(-) > create mode 100644 debian/templates/apache-site-https.conf.in > >diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create >index a36f7e3..a840f8e 100755 >--- a/debian/scripts/koha-create >+++ b/debian/scripts/koha-create >@@ -71,6 +71,7 @@ Options: > conjunction with --defaultsql and --populate-db. > --upload-path dir Set a user defined upload_path. It defaults to > /var/lib/koha/<instance>/uploads >+ --force-https Set up a https-only site with letsencrypt certificates > --help,-h Show this help. > > Note: the instance name cannot be longer that 11 chars. >@@ -354,6 +355,9 @@ END_BIBLIOS_RETRIEVAL_INFO="" > START_AUTHORITIES_RETRIEVAL_INFO="" > END_AUTHORITIES_RETRIEVAL_INFO="" > >+APACHE_CONFIGFILE="" >+LETSENCRYPT_PATH="" >+ > if [ -e /etc/koha/koha-sites.conf ] > then > . /etc/koha/koha-sites.conf >@@ -378,7 +382,6 @@ CLO_MEMCACHED_SERVERS="" > CLO_MEMCACHED_PREFIX="" > CLO_UPLOAD_PATH="" > >- > while true ; do > case "$1" in > -c|--create-db) >@@ -419,6 +422,10 @@ while true ; do > SRU_SERVER_PORT="$2" ; shift 2 ;; > --upload-path) > CLO_UPLOAD_PATH="$2" ; shift 2 ;; >+ --force-https) >+ USE_HTTPS="yes" ; shift ;; >+ --letsencrypt) >+ LETSENCRYPT_PATH="$2" ; shift 2 ;; > -h|--help) > usage ; exit 0 ;; > --) >@@ -598,8 +605,13 @@ FLUSH PRIVILEGES; > eof > fi #` > >+ if [ "$USE_HTTPS" = "yes" ]; then >+ APACHE_CONFIGFILE = "apache-site-https.conf.in" >+ else >+ APACHE_CONFIGFILE = "apache-site.conf.in" >+ fi > # Generate and install Apache site-available file and log dir. >- generate_config_file apache-site.conf.in \ >+ generate_config_file $APACHE_CONFIGFILE \ > "/etc/apache2/sites-available/$name.conf" > mkdir "/var/log/koha/$name" > chown "$username:$username" "/var/log/koha/$name" >@@ -708,6 +720,19 @@ then > # Start Indexer daemon > koha-indexer --start "$name" > fi >+ >+ if [ "$USE_HTTPS" = "yes" ]; then >+ # Get letsencrypt certificates >+ # TODO: fix path of letsencrypt >+ $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain >+ # enable all ssl settings (apache won't start with these before certs are present) >+ sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" >+ # change port from 80 to 443. (apache won't start if it is 443 without certs present) >+ sed -i "s:^\s*\(<VirtualHost \*\:\)80> #ssl$:\1443>:" "/etc/apache2/sites-available/$name.conf" >+ # TODO: enable forward from 80 to https >+ # restart apache with working certs >+ service apache2 restart >+ fi > fi > > >diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in >new file mode 100644 >index 0000000..dceca7c >--- /dev/null >+++ b/debian/templates/apache-site-https.conf.in >@@ -0,0 +1,68 @@ >+# Koha instance __KOHASITE__ Apache config. >+ >+#<VirtualHost *:80> #nohttps >+# RewriteEngine On >+# RewriteCond %{HTTPS} !=on >+# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] >+#</VirtualHost> >+ >+ >+# OPAC >+<VirtualHost *:80> #https >+# SSLEngine on >+# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 >+# SSLCompression off >+# SSLHonorCipherOrder on >+# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" >+# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem >+# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem >+# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem >+ >+ <IfVersion >= 2.4> >+ Define instance "__KOHASITE__" >+ </IfVersion> >+ Include /etc/koha/apache-shared.conf >+# Include /etc/koha/apache-shared-disable.conf >+# Include /etc/koha/apache-shared-opac-plack.conf >+ Include /etc/koha/apache-shared-opac.conf >+ >+ ServerName __OPACSERVER__ >+ SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" >+ SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" >+ SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" >+ AssignUserID __UNIXUSER__ __UNIXGROUP__ >+ >+ ErrorLog /var/log/koha/__KOHASITE__/opac-error.log >+# TransferLog /var/log/koha/__KOHASITE__/opac-access.log >+# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log >+</VirtualHost> >+ >+# Intranet >+<VirtualHost *:80> #https >+# SSLEngine on >+# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 >+# SSLCompression off >+# SSLHonorCipherOrder on >+# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" >+# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem >+# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem >+# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem >+ >+ <IfVersion >= 2.4> >+ Define instance "__KOHASITE__" >+ </IfVersion> >+ Include /etc/koha/apache-shared.conf >+# Include /etc/koha/apache-shared-disable.conf >+# Include /etc/koha/apache-shared-intranet-plack.conf >+ Include /etc/koha/apache-shared-intranet.conf >+ >+ ServerName __INTRASERVER__ >+ SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" >+ SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" >+ SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" >+ AssignUserID __UNIXUSER__ __UNIXGROUP__ >+ >+ ErrorLog /var/log/koha/__KOHASITE__/intranet-error.log >+# TransferLog /var/log/koha/__KOHASITE__/intranet-access.log >+# RewriteLog /var/log/koha/__KOHASITE__/intranet-rewrite.log >+</VirtualHost> >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 15303
:
45397
|
45399
|
45400
|
45402
|
45404
|
45408
|
45409
|
45414
|
45415
|
46116
|
46117
|
46118
|
46617
|
46742
|
46745
|
46746
|
46747
|
46748
|
46749
|
46750
|
46751
|
46752
|
49470
|
49471
|
50215
|
50216
|
50271
|
50283
|
50287
|
50307
|
50308
|
50309
|
50310
|
50311
|
50312
|
50313
|
50324