Bugzilla – Attachment 45409 Details for
Bug 15303
Letsencrypt option for Debian package installations
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 15303 Letsencrypt option for Debian package installations
Bug-15303-Letsencrypt-option-for-Debian-package-in.patch (text/plain), 10.09 KB, created by
Mirko Tietgen
on 2015-12-04 06:53:51 UTC
(
hide
)
Description:
Bug 15303 Letsencrypt option for Debian package installations
Filename:
MIME Type:
Creator:
Mirko Tietgen
Created:
2015-12-04 06:53:51 UTC
Size:
10.09 KB
patch
obsolete
>From c5a7a6ec20436852b1cfa5d7559b1db0a9ecaa9e Mon Sep 17 00:00:00 2001 >From: Mirko Tietgen <mirko@abunchofthings.net> >Date: Fri, 4 Dec 2015 01:11:17 +0100 >Subject: [PATCH] Bug 15303 Letsencrypt option for Debian package > installations > >Apache file for https only setups with automatic certificate >generation via letsencrypt. We need a workiung web server for >the letsencrypt magic, but we can't start on 443 without certs. >So we start on 80, get the certs, switch to 443 and restart >apache. 80 gets forwarded to https. > >New option koha-create --force-https >- generates letsencrypt certificates >- sets up a https-only website >- redirects 80 to https (not yet) > >Test plan: >- build a debian package with patch applied >- checkout letsencrypt on the machine where you are testing the package > git clone https://github.com/letsencrypt/letsencrypt >- use apache mod_ssl > sudo a2enmod ssl >- make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet >- install koha with your new package >- use koha-create with the new options: > sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt <instance> >- wait until setup is finished, check that you got a working OPAC and staff client with certificates > make sure to use https:// to open both sites > >Todo >- use letsencrypt default path in debian when we know where that is >- enable redirect from port 80 to https in apache config >--- > debian/docs/koha-create.xml | 17 +++++++ > debian/scripts/koha-create | 46 +++++++++++++++++-- > debian/templates/apache-site-https.conf.in | 68 ++++++++++++++++++++++++++++ > 3 files changed, 128 insertions(+), 3 deletions(-) > create mode 100644 debian/templates/apache-site-https.conf.in > >diff --git a/debian/docs/koha-create.xml b/debian/docs/koha-create.xml >index 92785ac..ede6561 100644 >--- a/debian/docs/koha-create.xml >+++ b/debian/docs/koha-create.xml >@@ -40,6 +40,8 @@ > <arg><option>--enable-sru</option></arg> > <arg><option>--sru-port</option> port</arg> > <arg><option>--upload-path</option> directory</arg> >+ <arg><option>--force-https</option></arg> >+ <arg><option>--letsencrypt</option> directory</arg> > <arg><option>--help</option>|<option>-h</option></arg> > > <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg> >@@ -177,6 +179,21 @@ > </varlistentry> > > <varlistentry> >+ <term><option>--force-https</option></term> >+ <listitem> >+ <para>Set up a https-only website</para> >+ </listitem> >+ </varlistentry> >+ >+ <varlistentry> >+ <term><option>--letsencrypt</option></term> >+ <listitem> >+ <para>Specify the <option>directory</option> where letsencrypt-auto lives >+ It defaults to <filename>/path/to/letsencrypt</filename>.</para> >+ </listitem> >+ </varlistentry> >+ >+ <varlistentry> > <term><option>--help</option>,<option>-h</option></term> > <listitem> > <para>Print usage information.</para> >diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create >index a36f7e3..6c8455c 100755 >--- a/debian/scripts/koha-create >+++ b/debian/scripts/koha-create >@@ -71,6 +71,8 @@ Options: > conjunction with --defaultsql and --populate-db. > --upload-path dir Set a user defined upload_path. It defaults to > /var/lib/koha/<instance>/uploads >+ --force-https Set up a https-only site with letsencrypt certificates >+ --letsencrypt Path to the letsencrypt folder > --help,-h Show this help. > > Note: the instance name cannot be longer that 11 chars. >@@ -192,6 +194,20 @@ EOM > die > fi > >+ # Check that mod_ssl is installed and enabled. >+ if [ "$USE_HTTPS" = "yes" ]; then >+ if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then >+ cat 1>&2 <<EOM >+ >+Koha requires mod_ssl to be enabled within Apache in order to run with --force-https. >+Typically this can be enabled with: >+ >+ sudo a2enmod ssl >+EOM >+ die >+ fi >+ fi >+ > } > > set_biblios_indexing_mode() >@@ -354,6 +370,9 @@ END_BIBLIOS_RETRIEVAL_INFO="" > START_AUTHORITIES_RETRIEVAL_INFO="" > END_AUTHORITIES_RETRIEVAL_INFO="" > >+APACHE_CONFIGFILE="" >+LETSENCRYPT_PATH="" >+ > if [ -e /etc/koha/koha-sites.conf ] > then > . /etc/koha/koha-sites.conf >@@ -361,7 +380,7 @@ fi > > [ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) > >-TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \ >+TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,force-https,letsencrypt:, \ > -n "$0" -- "$@"` > > # Note the quotes around `$TEMP': they are essential! >@@ -378,7 +397,6 @@ CLO_MEMCACHED_SERVERS="" > CLO_MEMCACHED_PREFIX="" > CLO_UPLOAD_PATH="" > >- > while true ; do > case "$1" in > -c|--create-db) >@@ -419,6 +437,10 @@ while true ; do > SRU_SERVER_PORT="$2" ; shift 2 ;; > --upload-path) > CLO_UPLOAD_PATH="$2" ; shift 2 ;; >+ --force-https) >+ USE_HTTPS="yes" ; shift ;; >+ --letsencrypt) >+ LETSENCRYPT_PATH="$2" ; shift 2 ;; > -h|--help) > usage ; exit 0 ;; > --) >@@ -598,8 +620,13 @@ FLUSH PRIVILEGES; > eof > fi #` > >+ if [ "$USE_HTTPS" = "yes" ]; then >+ APACHE_CONFIGFILE="apache-site-https.conf.in" >+ else >+ APACHE_CONFIGFILE="apache-site.conf.in" >+ fi > # Generate and install Apache site-available file and log dir. >- generate_config_file apache-site.conf.in \ >+ generate_config_file $APACHE_CONFIGFILE \ > "/etc/apache2/sites-available/$name.conf" > mkdir "/var/log/koha/$name" > chown "$username:$username" "/var/log/koha/$name" >@@ -708,6 +735,19 @@ then > # Start Indexer daemon > koha-indexer --start "$name" > fi >+ >+ if [ "$USE_HTTPS" = "yes" ]; then >+ # Get letsencrypt certificates >+ # TODO: fix path of letsencrypt >+ $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain >+ # enable all ssl settings (apache won't start with these before certs are present) >+ sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" >+ # change port from 80 to 443. (apache won't start if it is 443 without certs present) >+ sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf" >+ # TODO: enable forward from 80 to https >+ # restart apache with working certs >+ service apache2 restart >+ fi > fi > > >diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in >new file mode 100644 >index 0000000..dceca7c >--- /dev/null >+++ b/debian/templates/apache-site-https.conf.in >@@ -0,0 +1,68 @@ >+# Koha instance __KOHASITE__ Apache config. >+ >+#<VirtualHost *:80> #nohttps >+# RewriteEngine On >+# RewriteCond %{HTTPS} !=on >+# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] >+#</VirtualHost> >+ >+ >+# OPAC >+<VirtualHost *:80> #https >+# SSLEngine on >+# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 >+# SSLCompression off >+# SSLHonorCipherOrder on >+# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" >+# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem >+# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem >+# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem >+ >+ <IfVersion >= 2.4> >+ Define instance "__KOHASITE__" >+ </IfVersion> >+ Include /etc/koha/apache-shared.conf >+# Include /etc/koha/apache-shared-disable.conf >+# Include /etc/koha/apache-shared-opac-plack.conf >+ Include /etc/koha/apache-shared-opac.conf >+ >+ ServerName __OPACSERVER__ >+ SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" >+ SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" >+ SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" >+ AssignUserID __UNIXUSER__ __UNIXGROUP__ >+ >+ ErrorLog /var/log/koha/__KOHASITE__/opac-error.log >+# TransferLog /var/log/koha/__KOHASITE__/opac-access.log >+# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log >+</VirtualHost> >+ >+# Intranet >+<VirtualHost *:80> #https >+# SSLEngine on >+# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 >+# SSLCompression off >+# SSLHonorCipherOrder on >+# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" >+# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem >+# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem >+# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem >+ >+ <IfVersion >= 2.4> >+ Define instance "__KOHASITE__" >+ </IfVersion> >+ Include /etc/koha/apache-shared.conf >+# Include /etc/koha/apache-shared-disable.conf >+# Include /etc/koha/apache-shared-intranet-plack.conf >+ Include /etc/koha/apache-shared-intranet.conf >+ >+ ServerName __INTRASERVER__ >+ SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" >+ SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" >+ SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" >+ AssignUserID __UNIXUSER__ __UNIXGROUP__ >+ >+ ErrorLog /var/log/koha/__KOHASITE__/intranet-error.log >+# TransferLog /var/log/koha/__KOHASITE__/intranet-access.log >+# RewriteLog /var/log/koha/__KOHASITE__/intranet-rewrite.log >+</VirtualHost> >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 15303
:
45397
|
45399
|
45400
|
45402
|
45404
|
45408
|
45409
|
45414
|
45415
|
46116
|
46117
|
46118
|
46617
|
46742
|
46745
|
46746
|
46747
|
46748
|
46749
|
46750
|
46751
|
46752
|
49470
|
49471
|
50215
|
50216
|
50271
|
50283
|
50287
|
50307
|
50308
|
50309
|
50310
|
50311
|
50312
|
50313
|
50324