View | Details | Raw Unified | Return to bug 15303
Collapse All | Expand All

(-)a/debian/docs/koha-create.xml (+17 lines)
Lines 40-45 Link Here
40
      <arg><option>--enable-sru</option></arg>
40
      <arg><option>--enable-sru</option></arg>
41
      <arg><option>--sru-port</option> port</arg>
41
      <arg><option>--sru-port</option> port</arg>
42
      <arg><option>--upload-path</option> directory</arg>
42
      <arg><option>--upload-path</option> directory</arg>
43
      <arg><option>--force-https</option></arg>
44
      <arg><option>--letsencrypt</option> directory</arg>
43
      <arg><option>--help</option>|<option>-h</option></arg>
45
      <arg><option>--help</option>|<option>-h</option></arg>
44
46
45
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
47
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
Lines 177-182 Link Here
177
    </varlistentry>
179
    </varlistentry>
178
180
179
    <varlistentry>
181
    <varlistentry>
182
      <term><option>--force-https</option></term>
183
      <listitem>
184
        <para>Set up a https-only website</para>
185
      </listitem>
186
    </varlistentry>
187
188
    <varlistentry>
189
      <term><option>--letsencrypt</option></term>
190
      <listitem>
191
        <para>Specify the <option>directory</option> where letsencrypt-auto lives
192
              It defaults to <filename>/usr/bin</filename>.</para>
193
      </listitem>
194
    </varlistentry>
195
196
    <varlistentry>
180
      <term><option>--help</option>,<option>-h</option></term>
197
      <term><option>--help</option>,<option>-h</option></term>
181
      <listitem>
198
      <listitem>
182
        <para>Print usage information.</para>
199
        <para>Print usage information.</para>
(-)a/debian/scripts/koha-create (-3 / +56 lines)
Lines 71-76 Options: Link Here
71
                            conjunction with --defaultsql and --populate-db.
71
                            conjunction with --defaultsql and --populate-db.
72
  --upload-path dir         Set a user defined upload_path. It defaults to
72
  --upload-path dir         Set a user defined upload_path. It defaults to
73
                            /var/lib/koha/<instance>/uploads
73
                            /var/lib/koha/<instance>/uploads
74
  --force-https             Set up a https-only site with letsencrypt certificates
75
  --letsencrypt             Path to the letsencrypt folder
74
  --help,-h                 Show this help.
76
  --help,-h                 Show this help.
75
77
76
Note: the instance name cannot be longer that 11 chars.
78
Note: the instance name cannot be longer that 11 chars.
Lines 192-197 EOM Link Here
192
        die
194
        die
193
    fi
195
    fi
194
196
197
    # Check that mod_ssl is installed and enabled.
198
    if [ "$USE_HTTPS" = "yes" ]; then
199
        if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then
200
            cat 1>&2  <<EOM
201
202
Koha requires mod_ssl to be enabled within Apache in order to run with --force-https.
203
Typically this can be enabled with:
204
205
    sudo a2enmod ssl
206
EOM
207
            die
208
        fi
209
    fi
210
195
}
211
}
196
212
197
set_biblios_indexing_mode()
213
set_biblios_indexing_mode()
Lines 311-316 enable_sru_server() Link Here
311
    fi
327
    fi
312
}
328
}
313
329
330
letsencrypt_instance()
331
{
332
    # Get letsencrypt certificates
333
    $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly \
334
        -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain
335
    # enable all ssl settings (apache won't start with these before certs are present)
336
    sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf"
337
    # change port from 80 to 443. (apache won't start if it is 443 without certs present)
338
    sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf"
339
    # enable redirect from http to https on port 80
340
    sed -i "s:^\s*#\(.*\)#nohttps$:\1:" "/etc/apache2/sites-available/$name.conf"
341
    # make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead
342
    touch /var/lib/koha/$name/letsencrypt.enabled
343
    # restart apache with working certs
344
    service apache2 restart
345
}
346
314
# Set defaults and read config file, if it exists.
347
# Set defaults and read config file, if it exists.
315
DOMAIN=""
348
DOMAIN=""
316
OPACPORT="80"
349
OPACPORT="80"
Lines 354-359 END_BIBLIOS_RETRIEVAL_INFO="" Link Here
354
START_AUTHORITIES_RETRIEVAL_INFO=""
387
START_AUTHORITIES_RETRIEVAL_INFO=""
355
END_AUTHORITIES_RETRIEVAL_INFO=""
388
END_AUTHORITIES_RETRIEVAL_INFO=""
356
389
390
APACHE_CONFIGFILE=""
391
LETSENCRYPT_PATH="/usr/bin/"
392
357
if [ -e /etc/koha/koha-sites.conf ]
393
if [ -e /etc/koha/koha-sites.conf ]
358
then
394
then
359
    . /etc/koha/koha-sites.conf
395
    . /etc/koha/koha-sites.conf
Lines 361-367 fi Link Here
361
397
362
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
398
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
363
399
364
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \
400
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,force-https,letsencrypt:, \
365
     -n "$0" -- "$@"`
401
     -n "$0" -- "$@"`
366
402
367
# Note the quotes around `$TEMP': they are essential!
403
# Note the quotes around `$TEMP': they are essential!
Lines 378-384 CLO_MEMCACHED_SERVERS="" Link Here
378
CLO_MEMCACHED_PREFIX=""
414
CLO_MEMCACHED_PREFIX=""
379
CLO_UPLOAD_PATH=""
415
CLO_UPLOAD_PATH=""
380
416
381
382
while true ; do
417
while true ; do
383
    case "$1" in
418
    case "$1" in
384
        -c|--create-db)
419
        -c|--create-db)
Lines 419-424 while true ; do Link Here
419
            SRU_SERVER_PORT="$2" ; shift 2 ;;
454
            SRU_SERVER_PORT="$2" ; shift 2 ;;
420
        --upload-path)
455
        --upload-path)
421
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
456
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
457
        --force-https)
458
            USE_HTTPS="yes" ; shift ;;
459
        --letsencrypt)
460
            LETSENCRYPT_PATH="$2" ; shift 2 ;;
422
        -h|--help)
461
        -h|--help)
423
            usage ; exit 0 ;;
462
            usage ; exit 0 ;;
424
        --)
463
        --)
Lines 514-519 check_apache_config Link Here
514
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN"
553
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN"
515
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN"
554
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN"
516
555
556
# Check if letsencrypt path is valid, die otherwise
557
if [ ! -e "$LETSENCRYPT_PATH/letsencrypt-auto" ]; then
558
    die "Cannot find letsencrypt-auto in $LETSENCRYPT_PATH"
559
fi
517
560
518
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ]
561
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ]
519
then
562
then
Lines 598-605 FLUSH PRIVILEGES; Link Here
598
eof
641
eof
599
    fi #`
642
    fi #`
600
643
644
    if [ "$USE_HTTPS" = "yes" ]; then
645
        APACHE_CONFIGFILE="apache-site-https.conf.in"
646
    else
647
        APACHE_CONFIGFILE="apache-site.conf.in"
648
    fi
601
    # Generate and install Apache site-available file and log dir.
649
    # Generate and install Apache site-available file and log dir.
602
    generate_config_file apache-site.conf.in \
650
    generate_config_file $APACHE_CONFIGFILE \
603
        "/etc/apache2/sites-available/$name.conf"
651
        "/etc/apache2/sites-available/$name.conf"
604
    mkdir "/var/log/koha/$name"
652
    mkdir "/var/log/koha/$name"
605
    chown "$username:$username" "/var/log/koha/$name"
653
    chown "$username:$username" "/var/log/koha/$name"
Lines 708-713 then Link Here
708
        # Start Indexer daemon
756
        # Start Indexer daemon
709
        koha-indexer --start "$name"
757
        koha-indexer --start "$name"
710
    fi
758
    fi
759
760
    if [ "$USE_HTTPS" = "yes" ]; then
761
        # Get letsencrypt certificates
762
        letsencrypt_instance
763
    fi
711
fi
764
fi
712
765
713
766
(-)a/debian/scripts/koha-foreach (+2 lines)
Lines 30-35 do Link Here
30
        --nosip) listopts="$listopts --nosip";;
30
        --nosip) listopts="$listopts --nosip";;
31
        --plack) listopts="$listopts --plack";;
31
        --plack) listopts="$listopts --plack";;
32
      --noplack) listopts="$listopts --noplack";;
32
      --noplack) listopts="$listopts --noplack";;
33
  --letsencrypt) listopts="$listopts --letsencrypt" ;;
34
--noletsencrypt) listopts="$listopts --noletsencrypt" ;;
33
              *) break;;
35
              *) break;;
34
    esac
36
    esac
35
    shift
37
    shift
(-)a/debian/scripts/koha-functions.sh (+11 lines)
Lines 84-89 is_email_enabled() Link Here
84
    fi
84
    fi
85
}
85
}
86
86
87
is_letsencrypt_enabled()
88
{
89
    local instancename=$1
90
91
    if [ -e /var/lib/koha/$instancename/letsencrypt.enabled ]; then
92
        return 0
93
    else
94
        return 1
95
    fi
96
}
97
87
is_sip_enabled()
98
is_sip_enabled()
88
{
99
{
89
    local instancename=$1
100
    local instancename=$1
(-)a/debian/scripts/koha-list (-20 / +61 lines)
Lines 36-59 show_instances() Link Here
36
    for instance in $( get_instances ); do
36
    for instance in $( get_instances ); do
37
        case $show in
37
        case $show in
38
          "all")
38
          "all")
39
              if instance_filter_email $instance $show_email && \
39
              if instance_filter_email       $instance $show_email && \
40
                 instance_filter_plack $instance $show_plack && \
40
                 instance_filter_letsencrypt $instance $show_letsencrypt && \
41
                 instance_filter_sip   $instance $show_sip; then
41
                 instance_filter_plack       $instance $show_plack && \
42
                 instance_filter_sip         $instance $show_sip; then
42
                    echo $instance
43
                    echo $instance
43
              fi ;;
44
              fi ;;
44
          "enabled")
45
          "enabled")
45
              if is_enabled $instance; then
46
              if is_enabled $instance; then
46
                  if instance_filter_email $instance $show_email && \
47
                  if instance_filter_email       $instance $show_email && \
47
                     instance_filter_plack $instance $show_plack && \
48
                     instance_filter_letsencrypt $instance $show_letsencrypt && \
48
                     instance_filter_sip   $instance $show_sip; then
49
                     instance_filter_plack       $instance $show_plack && \
50
                     instance_filter_sip         $instance $show_sip; then
49
                      echo $instance
51
                      echo $instance
50
                  fi
52
                  fi
51
              fi ;;
53
              fi ;;
52
          "disabled")
54
          "disabled")
53
              if ! is_enabled $instance; then
55
              if ! is_enabled $instance; then
54
                  if instance_filter_email $instance $show_email && \
56
                  if instance_filter_email       $instance $show_email && \
55
                     instance_filter_plack $instance $show_plack && \
57
                     instance_filter_letsencrypt $instance $show_letsencrypt && \
56
                     instance_filter_sip   $instance $show_sip; then
58
                     instance_filter_plack       $instance $show_plack && \
59
                     instance_filter_sip         $instance $show_sip; then
57
                      echo $instance
60
                      echo $instance
58
                  fi
61
                  fi
59
              fi ;;
62
              fi ;;
Lines 106-111 instance_filter_plack() Link Here
106
    return 1
109
    return 1
107
}
110
}
108
111
112
instance_filter_letsencrypt()
113
{
114
    local instancename=$1
115
    local show_letsencrypt=$2;
116
117
    case $show_letsencrypt in
118
        "all")
119
            return 0 ;;
120
        "enabled")
121
            if is_letsencrypt_enabled $instancename; then
122
                return 0
123
            fi ;;
124
        "disabled")
125
            if ! is_letsencrypt_enabled $instancename; then
126
                return 0
127
            fi ;;
128
    esac
129
130
    # Didn't match any criteria
131
    return 1
132
}
133
109
instance_filter_email()
134
instance_filter_email()
110
{
135
{
111
    local instancename=$1
136
    local instancename=$1
Lines 150-155 set_show_email() Link Here
150
    fi
175
    fi
151
}
176
}
152
177
178
set_show_letsencrypt()
179
{
180
    local letsencrypt_param=$1
181
182
    if [ "$show_letsencrypt" = "all" ]; then
183
        show_letsencrypt=$letsencrypt_param
184
    else
185
        die "Error: --letsencrypt and --noletsencrypt are mutually exclusive."
186
    fi
187
}
188
153
set_show_plack()
189
set_show_plack()
154
{
190
{
155
    local plack_param=$1
191
    local plack_param=$1
Lines 190-195 Options: Link Here
190
    --nosip         Show instances with SIP disabled
226
    --nosip         Show instances with SIP disabled
191
    --plack         Show instances with Plack enabled
227
    --plack         Show instances with Plack enabled
192
    --noplack       Show instances with Plack disabled
228
    --noplack       Show instances with Plack disabled
229
    --letsencrypt   Show instances with letsencrypt enabled
230
    --noletsencrypt Show instances with letsencrypt disabled
193
    --help | -h     Show this help
231
    --help | -h     Show this help
194
232
195
The filtering options can be combined, and you probably want to do this
233
The filtering options can be combined, and you probably want to do this
Lines 201-223 show="all" Link Here
201
show_email="all"
239
show_email="all"
202
show_sip="all"
240
show_sip="all"
203
show_plack="all"
241
show_plack="all"
242
show_letsencrypt="all"
204
243
205
args=$(getopt -l help,enabled,disabled,email,noemail,sip,nosip,plack,noplack -o h -n $0 -- "$@")
244
args=$(getopt -l help,enabled,disabled,email,noemail,sip,nosip,plack,noplack,letsencrypt,noletsencrypt -o h -n $0 -- "$@")
206
set -- $args
245
set -- $args
207
246
208
while [ ! -z "$1" ]
247
while [ ! -z "$1" ]
209
do
248
do
210
    case "$1" in
249
    case "$1" in
211
  -h|--help) usage; exit;;
250
      -h|--help) usage; exit;;
212
    --email) set_show_email "enabled" ;;
251
        --email) set_show_email "enabled" ;;
213
  --noemail) set_show_email "disabled" ;;
252
      --noemail) set_show_email "disabled" ;;
214
      --sip) set_show_sip "enabled" ;;
253
          --sip) set_show_sip "enabled" ;;
215
    --nosip) set_show_sip "disabled" ;;
254
        --nosip) set_show_sip "disabled" ;;
216
    --plack) set_show_plack "enabled" ;;
255
        --plack) set_show_plack "enabled" ;;
217
  --noplack) set_show_plack "disabled" ;;
256
      --noplack) set_show_plack "disabled" ;;
218
  --enabled) set_show "enabled" ;;
257
  --letsencrypt) set_show_letsencrypt "enabled" ;;
219
 --disabled) set_show "disabled" ;;
258
--noletsencrypt) set_show_letsencrypt "disabled" ;;
220
          *) break;;
259
      --enabled) set_show "enabled" ;;
260
     --disabled) set_show "disabled" ;;
261
              *) break;;
221
    esac
262
    esac
222
    shift
263
    shift
223
done
264
done
(-)a/debian/templates/apache-site-https.conf.in (-1 / +68 lines)
Line 0 Link Here
0
- 
1
# Koha instance __KOHASITE__ Apache config.
2
3
# redirect http to https
4
#<VirtualHost *:80> #nohttps
5
#  RewriteEngine On #nohttps
6
#  RewriteCond %{HTTPS} !=on #nohttps
7
#  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] #nohttps
8
#</VirtualHost> #nohttps
9
10
# OPAC
11
<VirtualHost *:80> #https
12
#  SSLEngine on
13
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
14
#  SSLCompression off
15
#  SSLHonorCipherOrder on
16
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-
17
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
18
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
19
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
20
21
  <IfVersion >= 2.4>
22
   Define instance "__KOHASITE__"
23
  </IfVersion>
24
   Include /etc/koha/apache-shared.conf
25
#  Include /etc/koha/apache-shared-disable.conf
26
#  Include /etc/koha/apache-shared-opac-plack.conf
27
   Include /etc/koha/apache-shared-opac.conf
28
29
   ServerName __OPACSERVER__
30
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
31
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
32
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
33
   AssignUserID __UNIXUSER__ __UNIXGROUP__
34
35
   ErrorLog    /var/log/koha/__KOHASITE__/opac-error.log
36
#  TransferLog /var/log/koha/__KOHASITE__/opac-access.log
37
#  RewriteLog  /var/log/koha/__KOHASITE__/opac-rewrite.log
38
</VirtualHost>
39
40
# Intranet
41
<VirtualHost *:80> #https
42
#  SSLEngine on
43
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
44
#  SSLCompression off
45
#  SSLHonorCipherOrder on
46
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES
47
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
48
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
49
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
50
51
  <IfVersion >= 2.4>
52
   Define instance "__KOHASITE__"
53
  </IfVersion>
54
   Include /etc/koha/apache-shared.conf
55
#  Include /etc/koha/apache-shared-disable.conf
56
#  Include /etc/koha/apache-shared-intranet-plack.conf
57
   Include /etc/koha/apache-shared-intranet.conf
58
59
   ServerName __INTRASERVER__
60
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
61
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
62
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
63
   AssignUserID __UNIXUSER__ __UNIXGROUP__
64
65
   ErrorLog    /var/log/koha/__KOHASITE__/intranet-error.log
66
#  TransferLog /var/log/koha/__KOHASITE__/intranet-access.log
67
#  RewriteLog  /var/log/koha/__KOHASITE__/intranet-rewrite.log
68
</VirtualHost>

Return to bug 15303