@@ -, +, @@ - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) --- debian/scripts/koha-create | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) --- a/debian/scripts/koha-create +++ a/debian/scripts/koha-create @@ -71,6 +71,7 @@ Options: conjunction with --defaultsql and --populate-db. --upload-path dir Set a user defined upload_path. It defaults to /var/lib/koha//uploads + --force-https Set up a https-only site with letsencrypt certificates --help,-h Show this help. Note: the instance name cannot be longer that 11 chars. @@ -419,6 +420,8 @@ while true ; do SRU_SERVER_PORT="$2" ; shift 2 ;; --upload-path) CLO_UPLOAD_PATH="$2" ; shift 2 ;; + --force-https) + USE_HTTPS="yes" ; shift ;; -h|--help) usage ; exit 0 ;; --) @@ -708,6 +711,19 @@ then # Start Indexer daemon koha-indexer --start "$name" fi + + if [ "$USE_HTTPS" = "yes" ]; then + # Get letsencrypt certificates + # TODO: fix path of letsencrypt + /path/to/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain + # enable all ssl settings (apache won't start with these before certs are present) + sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" + # change port from 80 to 443. (apache won't start if it is 443 without certs present) + sed -i "s:^\s*\( #ssl$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # TODO: enable forward from 80 to https + # restart apache with working certs + service apache2 restart + fi fi --