@@ -, +, @@ installations - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) - sets the path where letsencrypt-auto lives - default value /usr/bin, but there is noch Debian package yet - build a debian package with patch applied - checkout letsencrypt on the machine where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - use apache mod_ssl sudo a2enmod ssl - make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet - install koha with your new package - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt - wait until setup is finished, check that you got a working OPAC and staff client with certificates make sure to use https:// to open both sites - check that http redirects to https --- debian/docs/koha-create.xml | 17 +++++++ debian/scripts/koha-create | 45 +++++++++++++++-- debian/templates/apache-site-https.conf.in | 72 ++++++++++++++++++++++++++++ 3 files changed, 131 insertions(+), 3 deletions(-) create mode 100644 debian/templates/apache-site-https.conf.in --- a/debian/docs/koha-create.xml +++ a/debian/docs/koha-create.xml @@ -40,6 +40,8 @@ port directory + + directory | instancename @@ -177,6 +179,21 @@ + + + Set up a https-only website + + + + + + + Specify the where letsencrypt-auto lives + It defaults to /path/to/letsencrypt. + + + + , Print usage information. --- a/debian/scripts/koha-create +++ a/debian/scripts/koha-create @@ -71,6 +71,8 @@ Options: conjunction with --defaultsql and --populate-db. --upload-path dir Set a user defined upload_path. It defaults to /var/lib/koha//uploads + --force-https Set up a https-only site with letsencrypt certificates + --letsencrypt Path to the letsencrypt folder --help,-h Show this help. Note: the instance name cannot be longer that 11 chars. @@ -192,6 +194,20 @@ EOM die fi + # Check that mod_ssl is installed and enabled. + if [ "$USE_HTTPS" = "yes" ]; then + if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then + cat 1>&2 < #https\)$:# \1:" "/etc/apache2/sites-available/$name.conf" + # change port from 80 to 443. (apache won't start if it is 443 without certs present) + sed -i "s:^\s*\( #https$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # restart apache with working certs + service apache2 restart + fi fi --- a/debian/templates/apache-site-https.conf.in +++ a/debian/templates/apache-site-https.conf.in @@ -0,0 +1,72 @@ +# Koha instance __KOHASITE__ Apache config. + + #https + + RewriteEngine On + RewriteCond %{HTTPS} !=on + RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] + + #https + +# OPAC + #https + #https + SSLEngine on + SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 + SSLCompression off + SSLHonorCipherOrder on + SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" + SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem + SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem + SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + #https + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-opac-plack.conf + Include /etc/koha/apache-shared-opac.conf + + ServerName __OPACSERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/opac-error.log +# TransferLog /var/log/koha/__KOHASITE__/opac-access.log +# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log + + +# Intranet + #https + #https + SSLEngine on + SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 + SSLCompression off + SSLHonorCipherOrder on + SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" + SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem + SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem + SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + #https + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-intranet-plack.conf + Include /etc/koha/apache-shared-intranet.conf + + ServerName __INTRASERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/intranet-error.log +# TransferLog /var/log/koha/__KOHASITE__/intranet-access.log +# RewriteLog /var/log/koha/__KOHASITE__/intranet-rewrite.log + --