From 54c140735a47ccac4b79aefd13f043a4d3c4ded4 Mon Sep 17 00:00:00 2001 From: Mirko Tietgen Date: Fri, 4 Dec 2015 01:11:17 +0100 Subject: [PATCH] Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) Test plan: - build a debian package with all patches for bug 15303 applied - checkout letsencrypt on the vm where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - install koha with your new package - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt - wait until setup is finished, check that you got a working OPAC and staff client with certificates Todo - use letsencrypt default path in debian when we know where that is - enable redirect from port 80 to https in apache config --- debian/docs/koha-create.xml | 17 +++++++ debian/scripts/koha-create | 32 +++++++++++-- debian/templates/apache-site-https.conf.in | 68 ++++++++++++++++++++++++++++ 3 files changed, 114 insertions(+), 3 deletions(-) create mode 100644 debian/templates/apache-site-https.conf.in diff --git a/debian/docs/koha-create.xml b/debian/docs/koha-create.xml index 92785ac..ede6561 100644 --- a/debian/docs/koha-create.xml +++ b/debian/docs/koha-create.xml @@ -40,6 +40,8 @@ port directory + + directory | instancename @@ -177,6 +179,21 @@ + + + Set up a https-only website + + + + + + + Specify the where letsencrypt-auto lives + It defaults to /path/to/letsencrypt. + + + + , Print usage information. diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create index a36f7e3..4511fd8 100755 --- a/debian/scripts/koha-create +++ b/debian/scripts/koha-create @@ -71,6 +71,8 @@ Options: conjunction with --defaultsql and --populate-db. --upload-path dir Set a user defined upload_path. It defaults to /var/lib/koha//uploads + --force-https Set up a https-only site with letsencrypt certificates + --letsencrypt Path to the letsencrypt folder --help,-h Show this help. Note: the instance name cannot be longer that 11 chars. @@ -354,6 +356,9 @@ END_BIBLIOS_RETRIEVAL_INFO="" START_AUTHORITIES_RETRIEVAL_INFO="" END_AUTHORITIES_RETRIEVAL_INFO="" +APACHE_CONFIGFILE="" +LETSENCRYPT_PATH="" + if [ -e /etc/koha/koha-sites.conf ] then . /etc/koha/koha-sites.conf @@ -361,7 +366,7 @@ fi [ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) -TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \ +TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,force-https,letsencrypt:, \ -n "$0" -- "$@"` # Note the quotes around `$TEMP': they are essential! @@ -378,7 +383,6 @@ CLO_MEMCACHED_SERVERS="" CLO_MEMCACHED_PREFIX="" CLO_UPLOAD_PATH="" - while true ; do case "$1" in -c|--create-db) @@ -419,6 +423,10 @@ while true ; do SRU_SERVER_PORT="$2" ; shift 2 ;; --upload-path) CLO_UPLOAD_PATH="$2" ; shift 2 ;; + --force-https) + USE_HTTPS="yes" ; shift ;; + --letsencrypt) + LETSENCRYPT_PATH="$2" ; shift 2 ;; -h|--help) usage ; exit 0 ;; --) @@ -598,8 +606,13 @@ FLUSH PRIVILEGES; eof fi #` + if [ "$USE_HTTPS" = "yes" ]; then + APACHE_CONFIGFILE="apache-site-https.conf.in" + else + APACHE_CONFIGFILE="apache-site.conf.in" + fi # Generate and install Apache site-available file and log dir. - generate_config_file apache-site.conf.in \ + generate_config_file $APACHE_CONFIGFILE \ "/etc/apache2/sites-available/$name.conf" mkdir "/var/log/koha/$name" chown "$username:$username" "/var/log/koha/$name" @@ -708,6 +721,19 @@ then # Start Indexer daemon koha-indexer --start "$name" fi + + if [ "$USE_HTTPS" = "yes" ]; then + # Get letsencrypt certificates + # TODO: fix path of letsencrypt + $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain + # enable all ssl settings (apache won't start with these before certs are present) + sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" + # change port from 80 to 443. (apache won't start if it is 443 without certs present) + sed -i "s:^\s*\( #ssl$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # TODO: enable forward from 80 to https + # restart apache with working certs + service apache2 restart + fi fi diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in new file mode 100644 index 0000000..dceca7c --- /dev/null +++ b/debian/templates/apache-site-https.conf.in @@ -0,0 +1,68 @@ +# Koha instance __KOHASITE__ Apache config. + +# #nohttps +# RewriteEngine On +# RewriteCond %{HTTPS} !=on +# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] +# + + +# OPAC + #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-opac-plack.conf + Include /etc/koha/apache-shared-opac.conf + + ServerName __OPACSERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/opac-error.log +# TransferLog /var/log/koha/__KOHASITE__/opac-access.log +# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log + + +# Intranet + #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-intranet-plack.conf + Include /etc/koha/apache-shared-intranet.conf + + ServerName __INTRASERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/intranet-error.log +# TransferLog /var/log/koha/__KOHASITE__/intranet-access.log +# RewriteLog /var/log/koha/__KOHASITE__/intranet-rewrite.log + -- 1.7.10.4