From f150486eedd702ae3f94e566e7db4017dbb9cfdb Mon Sep 17 00:00:00 2001 From: Mirko Tietgen Date: Fri, 4 Dec 2015 01:11:17 +0100 Subject: [PATCH] Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) New option --letsencrypt - sets the path where letsencrypt-auto lives - default value /usr/bin, but there is noch Debian package yet Test plan: - build a debian package with patch applied - checkout letsencrypt on the machine where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - use apache mod_ssl sudo a2enmod ssl - make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet - install koha with your new package - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt - wait until setup is finished, check that you got a working OPAC and staff client with certificates make sure to use https:// to open both sites - check that http redirects to https --- debian/docs/koha-create.xml | 17 +++++++ debian/scripts/koha-create | 45 +++++++++++++++-- debian/templates/apache-site-https.conf.in | 72 ++++++++++++++++++++++++++++ 3 files changed, 131 insertions(+), 3 deletions(-) create mode 100644 debian/templates/apache-site-https.conf.in diff --git a/debian/docs/koha-create.xml b/debian/docs/koha-create.xml index 92785ac..ede6561 100644 --- a/debian/docs/koha-create.xml +++ b/debian/docs/koha-create.xml @@ -40,6 +40,8 @@ port directory + + directory | instancename @@ -177,6 +179,21 @@ + + + Set up a https-only website + + + + + + + Specify the where letsencrypt-auto lives + It defaults to /path/to/letsencrypt. + + + + , Print usage information. diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create index a36f7e3..4363865 100755 --- a/debian/scripts/koha-create +++ b/debian/scripts/koha-create @@ -71,6 +71,8 @@ Options: conjunction with --defaultsql and --populate-db. --upload-path dir Set a user defined upload_path. It defaults to /var/lib/koha//uploads + --force-https Set up a https-only site with letsencrypt certificates + --letsencrypt Path to the letsencrypt folder --help,-h Show this help. Note: the instance name cannot be longer that 11 chars. @@ -192,6 +194,20 @@ EOM die fi + # Check that mod_ssl is installed and enabled. + if [ "$USE_HTTPS" = "yes" ]; then + if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then + cat 1>&2 < #https\)$:# \1:" "/etc/apache2/sites-available/$name.conf" + # change port from 80 to 443. (apache won't start if it is 443 without certs present) + sed -i "s:^\s*\( #https$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # restart apache with working certs + service apache2 restart + fi fi diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in new file mode 100644 index 0000000..f2bac01 --- /dev/null +++ b/debian/templates/apache-site-https.conf.in @@ -0,0 +1,72 @@ +# Koha instance __KOHASITE__ Apache config. + + #https + + RewriteEngine On + RewriteCond %{HTTPS} !=on + RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] + + #https + +# OPAC + #https + #https + SSLEngine on + SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 + SSLCompression off + SSLHonorCipherOrder on + SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" + SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem + SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem + SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + #https + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-opac-plack.conf + Include /etc/koha/apache-shared-opac.conf + + ServerName __OPACSERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/opac-error.log +# TransferLog /var/log/koha/__KOHASITE__/opac-access.log +# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log + + +# Intranet + #https + #https + SSLEngine on + SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 + SSLCompression off + SSLHonorCipherOrder on + SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" + SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem + SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem + SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + #https + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-intranet-plack.conf + Include /etc/koha/apache-shared-intranet.conf + + ServerName __INTRASERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/intranet-error.log +# TransferLog /var/log/koha/__KOHASITE__/intranet-access.log +# RewriteLog /var/log/koha/__KOHASITE__/intranet-rewrite.log + -- 1.7.10.4