View | Details | Raw Unified | Return to bug 15303
Collapse All | Expand All

(-)a/debian/docs/koha-create.xml (+17 lines)
Lines 40-45 Link Here
40
      <arg><option>--enable-sru</option></arg>
40
      <arg><option>--enable-sru</option></arg>
41
      <arg><option>--sru-port</option> port</arg>
41
      <arg><option>--sru-port</option> port</arg>
42
      <arg><option>--upload-path</option> directory</arg>
42
      <arg><option>--upload-path</option> directory</arg>
43
      <arg><option>--force-https</option></arg>
44
      <arg><option>--letsencrypt</option> directory</arg>
43
      <arg><option>--help</option>|<option>-h</option></arg>
45
      <arg><option>--help</option>|<option>-h</option></arg>
44
46
45
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
47
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
Lines 177-182 Link Here
177
    </varlistentry>
179
    </varlistentry>
178
180
179
    <varlistentry>
181
    <varlistentry>
182
      <term><option>--force-https</option></term>
183
      <listitem>
184
        <para>Set up a https-only website</para>
185
      </listitem>
186
    </varlistentry>
187
188
    <varlistentry>
189
      <term><option>--letsencrypt</option></term>
190
      <listitem>
191
        <para>Specify the <option>directory</option> where letsencrypt-auto lives
192
              It defaults to <filename>/usr/bin</filename>.</para>
193
      </listitem>
194
    </varlistentry>
195
196
    <varlistentry>
180
      <term><option>--help</option>,<option>-h</option></term>
197
      <term><option>--help</option>,<option>-h</option></term>
181
      <listitem>
198
      <listitem>
182
        <para>Print usage information.</para>
199
        <para>Print usage information.</para>
(-)a/debian/scripts/koha-create (-3 / +42 lines)
Lines 71-76 Options: Link Here
71
                            conjunction with --defaultsql and --populate-db.
71
                            conjunction with --defaultsql and --populate-db.
72
  --upload-path dir         Set a user defined upload_path. It defaults to
72
  --upload-path dir         Set a user defined upload_path. It defaults to
73
                            /var/lib/koha/<instance>/uploads
73
                            /var/lib/koha/<instance>/uploads
74
  --force-https             Set up a https-only site with letsencrypt certificates
75
  --letsencrypt             Path to the letsencrypt folder
74
  --help,-h                 Show this help.
76
  --help,-h                 Show this help.
75
77
76
Note: the instance name cannot be longer that 11 chars.
78
Note: the instance name cannot be longer that 11 chars.
Lines 192-197 EOM Link Here
192
        die
194
        die
193
    fi
195
    fi
194
196
197
    # Check that mod_ssl is installed and enabled.
198
    if [ "$USE_HTTPS" = "yes" ]; then
199
        if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then
200
            cat 1>&2  <<EOM
201
202
Koha requires mod_ssl to be enabled within Apache in order to run with --force-https.
203
Typically this can be enabled with:
204
205
    sudo a2enmod ssl
206
EOM
207
            die
208
        fi
209
    fi
210
195
}
211
}
196
212
197
set_biblios_indexing_mode()
213
set_biblios_indexing_mode()
Lines 354-359 END_BIBLIOS_RETRIEVAL_INFO="" Link Here
354
START_AUTHORITIES_RETRIEVAL_INFO=""
370
START_AUTHORITIES_RETRIEVAL_INFO=""
355
END_AUTHORITIES_RETRIEVAL_INFO=""
371
END_AUTHORITIES_RETRIEVAL_INFO=""
356
372
373
APACHE_CONFIGFILE=""
374
LETSENCRYPT_PATH="/usr/bin/"
375
357
if [ -e /etc/koha/koha-sites.conf ]
376
if [ -e /etc/koha/koha-sites.conf ]
358
then
377
then
359
    . /etc/koha/koha-sites.conf
378
    . /etc/koha/koha-sites.conf
Lines 361-367 fi Link Here
361
380
362
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
381
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
363
382
364
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \
383
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,force-https,letsencrypt:, \
365
     -n "$0" -- "$@"`
384
     -n "$0" -- "$@"`
366
385
367
# Note the quotes around `$TEMP': they are essential!
386
# Note the quotes around `$TEMP': they are essential!
Lines 378-384 CLO_MEMCACHED_SERVERS="" Link Here
378
CLO_MEMCACHED_PREFIX=""
397
CLO_MEMCACHED_PREFIX=""
379
CLO_UPLOAD_PATH=""
398
CLO_UPLOAD_PATH=""
380
399
381
382
while true ; do
400
while true ; do
383
    case "$1" in
401
    case "$1" in
384
        -c|--create-db)
402
        -c|--create-db)
Lines 419-424 while true ; do Link Here
419
            SRU_SERVER_PORT="$2" ; shift 2 ;;
437
            SRU_SERVER_PORT="$2" ; shift 2 ;;
420
        --upload-path)
438
        --upload-path)
421
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
439
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
440
        --force-https)
441
            USE_HTTPS="yes" ; shift ;;
442
        --letsencrypt)
443
            LETSENCRYPT_PATH="$2" ; shift 2 ;;
422
        -h|--help)
444
        -h|--help)
423
            usage ; exit 0 ;;
445
            usage ; exit 0 ;;
424
        --)
446
        --)
Lines 598-605 FLUSH PRIVILEGES; Link Here
598
eof
620
eof
599
    fi #`
621
    fi #`
600
622
623
    if [ "$USE_HTTPS" = "yes" ]; then
624
        APACHE_CONFIGFILE="apache-site-https.conf.in"
625
    else
626
        APACHE_CONFIGFILE="apache-site.conf.in"
627
    fi
601
    # Generate and install Apache site-available file and log dir.
628
    # Generate and install Apache site-available file and log dir.
602
    generate_config_file apache-site.conf.in \
629
    generate_config_file $APACHE_CONFIGFILE \
603
        "/etc/apache2/sites-available/$name.conf"
630
        "/etc/apache2/sites-available/$name.conf"
604
    mkdir "/var/log/koha/$name"
631
    mkdir "/var/log/koha/$name"
605
    chown "$username:$username" "/var/log/koha/$name"
632
    chown "$username:$username" "/var/log/koha/$name"
Lines 708-713 then Link Here
708
        # Start Indexer daemon
735
        # Start Indexer daemon
709
        koha-indexer --start "$name"
736
        koha-indexer --start "$name"
710
    fi
737
    fi
738
739
    if [ "$USE_HTTPS" = "yes" ]; then
740
        # Get letsencrypt certificates
741
        # TODO: fix path of letsencrypt
742
        $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain
743
        # enable all ssl settings (apache won't start with these before certs are present)
744
        sed -i "s:^\s*\(<.*IfDefine.*> #https\)$:# \1:" "/etc/apache2/sites-available/$name.conf"
745
        # change port from 80 to 443. (apache won't start if it is 443 without certs present)
746
        sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf"
747
        # restart apache with working certs
748
        service apache2 restart
749
    fi
711
fi
750
fi
712
751
713
752
(-)a/debian/templates/apache-site-https.conf.in (-1 / +72 lines)
Line 0 Link Here
0
- 
1
# Koha instance __KOHASITE__ Apache config.
2
3
<IfDefine DisabledOption> #https
4
<VirtualHost *:80>
5
  RewriteEngine On
6
  RewriteCond %{HTTPS} !=on
7
  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
8
</VirtualHost>
9
</IfDefine> #https
10
11
# OPAC
12
<VirtualHost *:80> #https
13
 <IfDefine DisabledOption> #https
14
   SSLEngine on
15
   SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
16
   SSLCompression off
17
   SSLHonorCipherOrder on
18
   SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA"
19
   SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
20
   SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
21
   SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
22
 </IfDefine> #https
23
24
  <IfVersion >= 2.4>
25
   Define instance "__KOHASITE__"
26
  </IfVersion>
27
   Include /etc/koha/apache-shared.conf
28
#  Include /etc/koha/apache-shared-disable.conf
29
#  Include /etc/koha/apache-shared-opac-plack.conf
30
   Include /etc/koha/apache-shared-opac.conf
31
32
   ServerName __OPACSERVER__
33
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
34
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
35
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
36
   AssignUserID __UNIXUSER__ __UNIXGROUP__
37
38
   ErrorLog    /var/log/koha/__KOHASITE__/opac-error.log
39
#  TransferLog /var/log/koha/__KOHASITE__/opac-access.log
40
#  RewriteLog  /var/log/koha/__KOHASITE__/opac-rewrite.log
41
</VirtualHost>
42
43
# Intranet
44
<VirtualHost *:80> #https
45
 <IfDefine DisabledOption> #https
46
   SSLEngine on
47
   SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
48
   SSLCompression off
49
   SSLHonorCipherOrder on
50
   SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA"
51
   SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
52
   SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
53
   SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
54
 </IfDefine> #https
55
  <IfVersion >= 2.4>
56
   Define instance "__KOHASITE__"
57
  </IfVersion>
58
   Include /etc/koha/apache-shared.conf
59
#  Include /etc/koha/apache-shared-disable.conf
60
#  Include /etc/koha/apache-shared-intranet-plack.conf
61
   Include /etc/koha/apache-shared-intranet.conf
62
63
   ServerName __INTRASERVER__
64
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
65
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
66
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
67
   AssignUserID __UNIXUSER__ __UNIXGROUP__
68
69
   ErrorLog    /var/log/koha/__KOHASITE__/intranet-error.log
70
#  TransferLog /var/log/koha/__KOHASITE__/intranet-access.log
71
#  RewriteLog  /var/log/koha/__KOHASITE__/intranet-rewrite.log
72
</VirtualHost>

Return to bug 15303