From 5bb46b36c9eeda17f71fccaeaa17cfbf53d8423f Mon Sep 17 00:00:00 2001 From: Mirko Tietgen Date: Fri, 4 Dec 2015 01:11:17 +0100 Subject: [PATCH] Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) --- debian/scripts/koha-create | 29 +++++++++++- debian/templates/apache-site-https.conf.in | 68 ++++++++++++++++++++++++++++ 2 files changed, 95 insertions(+), 2 deletions(-) create mode 100644 debian/templates/apache-site-https.conf.in diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create index a36f7e3..a840f8e 100755 --- a/debian/scripts/koha-create +++ b/debian/scripts/koha-create @@ -71,6 +71,7 @@ Options: conjunction with --defaultsql and --populate-db. --upload-path dir Set a user defined upload_path. It defaults to /var/lib/koha//uploads + --force-https Set up a https-only site with letsencrypt certificates --help,-h Show this help. Note: the instance name cannot be longer that 11 chars. @@ -354,6 +355,9 @@ END_BIBLIOS_RETRIEVAL_INFO="" START_AUTHORITIES_RETRIEVAL_INFO="" END_AUTHORITIES_RETRIEVAL_INFO="" +APACHE_CONFIGFILE="" +LETSENCRYPT_PATH="" + if [ -e /etc/koha/koha-sites.conf ] then . /etc/koha/koha-sites.conf @@ -378,7 +382,6 @@ CLO_MEMCACHED_SERVERS="" CLO_MEMCACHED_PREFIX="" CLO_UPLOAD_PATH="" - while true ; do case "$1" in -c|--create-db) @@ -419,6 +422,10 @@ while true ; do SRU_SERVER_PORT="$2" ; shift 2 ;; --upload-path) CLO_UPLOAD_PATH="$2" ; shift 2 ;; + --force-https) + USE_HTTPS="yes" ; shift ;; + --letsencrypt) + LETSENCRYPT_PATH="$2" ; shift 2 ;; -h|--help) usage ; exit 0 ;; --) @@ -598,8 +605,13 @@ FLUSH PRIVILEGES; eof fi #` + if [ "$USE_HTTPS" = "yes" ]; then + APACHE_CONFIGFILE = "apache-site-https.conf.in" + else + APACHE_CONFIGFILE = "apache-site.conf.in" + fi # Generate and install Apache site-available file and log dir. - generate_config_file apache-site.conf.in \ + generate_config_file $APACHE_CONFIGFILE \ "/etc/apache2/sites-available/$name.conf" mkdir "/var/log/koha/$name" chown "$username:$username" "/var/log/koha/$name" @@ -708,6 +720,19 @@ then # Start Indexer daemon koha-indexer --start "$name" fi + + if [ "$USE_HTTPS" = "yes" ]; then + # Get letsencrypt certificates + # TODO: fix path of letsencrypt + $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain + # enable all ssl settings (apache won't start with these before certs are present) + sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" + # change port from 80 to 443. (apache won't start if it is 443 without certs present) + sed -i "s:^\s*\( #ssl$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # TODO: enable forward from 80 to https + # restart apache with working certs + service apache2 restart + fi fi diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in new file mode 100644 index 0000000..dceca7c --- /dev/null +++ b/debian/templates/apache-site-https.conf.in @@ -0,0 +1,68 @@ +# Koha instance __KOHASITE__ Apache config. + +# #nohttps +# RewriteEngine On +# RewriteCond %{HTTPS} !=on +# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] +# + + +# OPAC + #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-opac-plack.conf + Include /etc/koha/apache-shared-opac.conf + + ServerName __OPACSERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/opac-error.log +# TransferLog /var/log/koha/__KOHASITE__/opac-access.log +# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log + + +# Intranet + #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-intranet-plack.conf + Include /etc/koha/apache-shared-intranet.conf + + ServerName __INTRASERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/intranet-error.log +# TransferLog /var/log/koha/__KOHASITE__/intranet-access.log +# RewriteLog /var/log/koha/__KOHASITE__/intranet-rewrite.log + -- 1.7.10.4