View | Details | Raw Unified | Return to bug 15303
Collapse All | Expand All

(-)a/debian/control.in (-1 / +2 lines)
Lines 35-41 Depends: ${misc:Depends}, ${koha:Depends}, Link Here
35
 xmlstarlet,
35
 xmlstarlet,
36
 yaz
36
 yaz
37
Suggests: mysql-server | virtual-mysql-server,
37
Suggests: mysql-server | virtual-mysql-server,
38
 memcached
38
 memcached,
39
letsencrypt
39
Homepage: http://koha-community.org/
40
Homepage: http://koha-community.org/
40
Description: integrated (physical) library management system
41
Description: integrated (physical) library management system
41
 Koha is an Integrated Library Management system for real-world libraries
42
 Koha is an Integrated Library Management system for real-world libraries
(-)a/debian/docs/koha-create.xml (+8 lines)
Lines 40-45 Link Here
40
      <arg><option>--enable-sru</option></arg>
40
      <arg><option>--enable-sru</option></arg>
41
      <arg><option>--sru-port</option> port</arg>
41
      <arg><option>--sru-port</option> port</arg>
42
      <arg><option>--upload-path</option> directory</arg>
42
      <arg><option>--upload-path</option> directory</arg>
43
      <arg><option>--letsencrypt</option></arg>
43
      <arg><option>--help</option>|<option>-h</option></arg>
44
      <arg><option>--help</option>|<option>-h</option></arg>
44
45
45
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
46
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
Lines 177-182 Link Here
177
    </varlistentry>
178
    </varlistentry>
178
179
179
    <varlistentry>
180
    <varlistentry>
181
      <term><option>--letsencrypt</option></term>
182
      <listitem>
183
        <para>Set up a https-only website with letsencrypt cerificates</para>
184
      </listitem>
185
    </varlistentry>
186
187
    <varlistentry>
180
      <term><option>--help</option>,<option>-h</option></term>
188
      <term><option>--help</option>,<option>-h</option></term>
181
      <listitem>
189
      <listitem>
182
        <para>Print usage information.</para>
190
        <para>Print usage information.</para>
(-)a/debian/scripts/koha-create (-3 / +68 lines)
Lines 71-76 Options: Link Here
71
                            conjunction with --defaultsql and --populate-db.
71
                            conjunction with --defaultsql and --populate-db.
72
  --upload-path dir         Set a user defined upload_path. It defaults to
72
  --upload-path dir         Set a user defined upload_path. It defaults to
73
                            /var/lib/koha/<instance>/uploads
73
                            /var/lib/koha/<instance>/uploads
74
  --letsencrypt             Set up a https-only site with letsencrypt certificates
74
  --help,-h                 Show this help.
75
  --help,-h                 Show this help.
75
76
76
Note: the instance name cannot be longer that 11 chars.
77
Note: the instance name cannot be longer that 11 chars.
Lines 192-197 EOM Link Here
192
        die
193
        die
193
    fi
194
    fi
194
195
196
    # Check that mod_ssl is installed and enabled.
197
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
198
        if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then
199
            cat 1>&2  <<EOM
200
201
Koha requires mod_ssl to be enabled within Apache in order to run with --letsencrypt.
202
Typically this can be enabled with:
203
204
    sudo a2enmod ssl
205
EOM
206
            die
207
        fi
208
    fi
209
195
}
210
}
196
211
197
set_biblios_indexing_mode()
212
set_biblios_indexing_mode()
Lines 311-316 enable_sru_server() Link Here
311
    fi
326
    fi
312
}
327
}
313
328
329
check_letsencrypt()
330
{
331
    if [ $(dpkg-query -W -f='${Status}' letsencrypt 2>/dev/null | grep -c "ok installed") -eq 0 ]; then
332
        apt-cache show letsencrypt &>/dev/null
333
        if [ $? -eq 0 ]; then
334
                read -r -p "The letsencrypt package is not installed. Do it now?  [y/N] " response
335
                if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then
336
                    apt-get install -y letsencrypt
337
                else
338
                    die "You have to install letsencrypt to use the --letsencrypt parameter."
339
                fi
340
        else
341
            die "No installation candidate available for package letsencrypt."
342
        fi
343
    fi
344
}
345
346
letsencrypt_instance()
347
{
348
    # Get letsencrypt certificates
349
    letsencrypt --agree-tos --renew-by-default --webroot --staging certonly \
350
        -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain
351
    # enable all ssl settings (apache won't start with these before certs are present)
352
    sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf"
353
    # change port from 80 to 443. (apache won't start if it is 443 without certs present)
354
    sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf"
355
    # enable redirect from http to https on port 80
356
    sed -i "s:^\s*#\(.*\)#nohttps$:\1:" "/etc/apache2/sites-available/$name.conf"
357
    # make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead
358
    touch /var/lib/koha/$name/letsencrypt.enabled
359
    # restart apache with working certs
360
    service apache2 restart
361
}
362
314
# Set defaults and read config file, if it exists.
363
# Set defaults and read config file, if it exists.
315
DOMAIN=""
364
DOMAIN=""
316
OPACPORT="80"
365
OPACPORT="80"
Lines 354-359 END_BIBLIOS_RETRIEVAL_INFO="" Link Here
354
START_AUTHORITIES_RETRIEVAL_INFO=""
403
START_AUTHORITIES_RETRIEVAL_INFO=""
355
END_AUTHORITIES_RETRIEVAL_INFO=""
404
END_AUTHORITIES_RETRIEVAL_INFO=""
356
405
406
APACHE_CONFIGFILE=""
407
357
if [ -e /etc/koha/koha-sites.conf ]
408
if [ -e /etc/koha/koha-sites.conf ]
358
then
409
then
359
    . /etc/koha/koha-sites.conf
410
    . /etc/koha/koha-sites.conf
Lines 361-367 fi Link Here
361
412
362
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
413
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
363
414
364
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \
415
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt, \
365
     -n "$0" -- "$@"`
416
     -n "$0" -- "$@"`
366
417
367
# Note the quotes around `$TEMP': they are essential!
418
# Note the quotes around `$TEMP': they are essential!
Lines 377-383 CLO_AUTHORITIES_INDEXING_MODE="" Link Here
377
CLO_MEMCACHED_SERVERS=""
428
CLO_MEMCACHED_SERVERS=""
378
CLO_MEMCACHED_PREFIX=""
429
CLO_MEMCACHED_PREFIX=""
379
CLO_UPLOAD_PATH=""
430
CLO_UPLOAD_PATH=""
380
431
CLO_LETSENCRYPT=""
381
432
382
while true ; do
433
while true ; do
383
    case "$1" in
434
    case "$1" in
Lines 419-424 while true ; do Link Here
419
            SRU_SERVER_PORT="$2" ; shift 2 ;;
470
            SRU_SERVER_PORT="$2" ; shift 2 ;;
420
        --upload-path)
471
        --upload-path)
421
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
472
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
473
        --letsencrypt)
474
            CLO_LETSENCRYPT="yes" ; shift ;;
422
        -h|--help)
475
        -h|--help)
423
            usage ; exit 0 ;;
476
            usage ; exit 0 ;;
424
        --)
477
        --)
Lines 514-519 check_apache_config Link Here
514
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN"
567
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN"
515
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN"
568
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN"
516
569
570
# Check everything is ok with letsencrypt, die otherwise
571
check_letsencrypt
517
572
518
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ]
573
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ]
519
then
574
then
Lines 598-605 FLUSH PRIVILEGES; Link Here
598
eof
653
eof
599
    fi #`
654
    fi #`
600
655
656
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
657
        APACHE_CONFIGFILE="apache-site-https.conf.in"
658
    else
659
        APACHE_CONFIGFILE="apache-site.conf.in"
660
    fi
601
    # Generate and install Apache site-available file and log dir.
661
    # Generate and install Apache site-available file and log dir.
602
    generate_config_file apache-site.conf.in \
662
    generate_config_file $APACHE_CONFIGFILE \
603
        "/etc/apache2/sites-available/$name.conf"
663
        "/etc/apache2/sites-available/$name.conf"
604
    mkdir "/var/log/koha/$name"
664
    mkdir "/var/log/koha/$name"
605
    chown "$username:$username" "/var/log/koha/$name"
665
    chown "$username:$username" "/var/log/koha/$name"
Lines 708-713 then Link Here
708
        # Start Indexer daemon
768
        # Start Indexer daemon
709
        koha-indexer --start "$name"
769
        koha-indexer --start "$name"
710
    fi
770
    fi
771
772
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
773
        # Get letsencrypt certificates
774
        letsencrypt_instance
775
    fi
711
fi
776
fi
712
777
713
778
(-)a/debian/scripts/koha-foreach (+2 lines)
Lines 30-35 do Link Here
30
        --nosip) listopts="$listopts --nosip";;
30
        --nosip) listopts="$listopts --nosip";;
31
        --plack) listopts="$listopts --plack";;
31
        --plack) listopts="$listopts --plack";;
32
      --noplack) listopts="$listopts --noplack";;
32
      --noplack) listopts="$listopts --noplack";;
33
  --letsencrypt) listopts="$listopts --letsencrypt" ;;
34
--noletsencrypt) listopts="$listopts --noletsencrypt" ;;
33
              *) break;;
35
              *) break;;
34
    esac
36
    esac
35
    shift
37
    shift
(-)a/debian/scripts/koha-functions.sh (+11 lines)
Lines 84-89 is_email_enabled() Link Here
84
    fi
84
    fi
85
}
85
}
86
86
87
is_letsencrypt_enabled()
88
{
89
    local instancename=$1
90
91
    if [ -e /var/lib/koha/$instancename/letsencrypt.enabled ]; then
92
        return 0
93
    else
94
        return 1
95
    fi
96
}
97
87
is_sip_enabled()
98
is_sip_enabled()
88
{
99
{
89
    local instancename=$1
100
    local instancename=$1
(-)a/debian/scripts/koha-list (-20 / +61 lines)
Lines 36-59 show_instances() Link Here
36
    for instance in $( get_instances ); do
36
    for instance in $( get_instances ); do
37
        case $show in
37
        case $show in
38
          "all")
38
          "all")
39
              if instance_filter_email $instance $show_email && \
39
              if instance_filter_email       $instance $show_email && \
40
                 instance_filter_plack $instance $show_plack && \
40
                 instance_filter_letsencrypt $instance $show_letsencrypt && \
41
                 instance_filter_sip   $instance $show_sip; then
41
                 instance_filter_plack       $instance $show_plack && \
42
                 instance_filter_sip         $instance $show_sip; then
42
                    echo $instance
43
                    echo $instance
43
              fi ;;
44
              fi ;;
44
          "enabled")
45
          "enabled")
45
              if is_enabled $instance; then
46
              if is_enabled $instance; then
46
                  if instance_filter_email $instance $show_email && \
47
                  if instance_filter_email       $instance $show_email && \
47
                     instance_filter_plack $instance $show_plack && \
48
                     instance_filter_letsencrypt $instance $show_letsencrypt && \
48
                     instance_filter_sip   $instance $show_sip; then
49
                     instance_filter_plack       $instance $show_plack && \
50
                     instance_filter_sip         $instance $show_sip; then
49
                      echo $instance
51
                      echo $instance
50
                  fi
52
                  fi
51
              fi ;;
53
              fi ;;
52
          "disabled")
54
          "disabled")
53
              if ! is_enabled $instance; then
55
              if ! is_enabled $instance; then
54
                  if instance_filter_email $instance $show_email && \
56
                  if instance_filter_email       $instance $show_email && \
55
                     instance_filter_plack $instance $show_plack && \
57
                     instance_filter_letsencrypt $instance $show_letsencrypt && \
56
                     instance_filter_sip   $instance $show_sip; then
58
                     instance_filter_plack       $instance $show_plack && \
59
                     instance_filter_sip         $instance $show_sip; then
57
                      echo $instance
60
                      echo $instance
58
                  fi
61
                  fi
59
              fi ;;
62
              fi ;;
Lines 106-111 instance_filter_plack() Link Here
106
    return 1
109
    return 1
107
}
110
}
108
111
112
instance_filter_letsencrypt()
113
{
114
    local instancename=$1
115
    local show_letsencrypt=$2;
116
117
    case $show_letsencrypt in
118
        "all")
119
            return 0 ;;
120
        "enabled")
121
            if is_letsencrypt_enabled $instancename; then
122
                return 0
123
            fi ;;
124
        "disabled")
125
            if ! is_letsencrypt_enabled $instancename; then
126
                return 0
127
            fi ;;
128
    esac
129
130
    # Didn't match any criteria
131
    return 1
132
}
133
109
instance_filter_email()
134
instance_filter_email()
110
{
135
{
111
    local instancename=$1
136
    local instancename=$1
Lines 150-155 set_show_email() Link Here
150
    fi
175
    fi
151
}
176
}
152
177
178
set_show_letsencrypt()
179
{
180
    local letsencrypt_param=$1
181
182
    if [ "$show_letsencrypt" = "all" ]; then
183
        show_letsencrypt=$letsencrypt_param
184
    else
185
        die "Error: --letsencrypt and --noletsencrypt are mutually exclusive."
186
    fi
187
}
188
153
set_show_plack()
189
set_show_plack()
154
{
190
{
155
    local plack_param=$1
191
    local plack_param=$1
Lines 190-195 Options: Link Here
190
    --nosip         Show instances with SIP disabled
226
    --nosip         Show instances with SIP disabled
191
    --plack         Show instances with Plack enabled
227
    --plack         Show instances with Plack enabled
192
    --noplack       Show instances with Plack disabled
228
    --noplack       Show instances with Plack disabled
229
    --letsencrypt   Show instances with letsencrypt enabled
230
    --noletsencrypt Show instances with letsencrypt disabled
193
    --help | -h     Show this help
231
    --help | -h     Show this help
194
232
195
The filtering options can be combined, and you probably want to do this
233
The filtering options can be combined, and you probably want to do this
Lines 201-223 show="all" Link Here
201
show_email="all"
239
show_email="all"
202
show_sip="all"
240
show_sip="all"
203
show_plack="all"
241
show_plack="all"
242
show_letsencrypt="all"
204
243
205
args=$(getopt -l help,enabled,disabled,email,noemail,sip,nosip,plack,noplack -o h -n $0 -- "$@")
244
args=$(getopt -l help,enabled,disabled,email,noemail,sip,nosip,plack,noplack,letsencrypt,noletsencrypt -o h -n $0 -- "$@")
206
set -- $args
245
set -- $args
207
246
208
while [ ! -z "$1" ]
247
while [ ! -z "$1" ]
209
do
248
do
210
    case "$1" in
249
    case "$1" in
211
  -h|--help) usage; exit;;
250
      -h|--help) usage; exit;;
212
    --email) set_show_email "enabled" ;;
251
        --email) set_show_email "enabled" ;;
213
  --noemail) set_show_email "disabled" ;;
252
      --noemail) set_show_email "disabled" ;;
214
      --sip) set_show_sip "enabled" ;;
253
          --sip) set_show_sip "enabled" ;;
215
    --nosip) set_show_sip "disabled" ;;
254
        --nosip) set_show_sip "disabled" ;;
216
    --plack) set_show_plack "enabled" ;;
255
        --plack) set_show_plack "enabled" ;;
217
  --noplack) set_show_plack "disabled" ;;
256
      --noplack) set_show_plack "disabled" ;;
218
  --enabled) set_show "enabled" ;;
257
  --letsencrypt) set_show_letsencrypt "enabled" ;;
219
 --disabled) set_show "disabled" ;;
258
--noletsencrypt) set_show_letsencrypt "disabled" ;;
220
          *) break;;
259
      --enabled) set_show "enabled" ;;
260
     --disabled) set_show "disabled" ;;
261
              *) break;;
221
    esac
262
    esac
222
    shift
263
    shift
223
done
264
done
(-)a/debian/templates/apache-site-https.conf.in (+68 lines)
Line 0 Link Here
1
# Koha instance __KOHASITE__ Apache config.
2
3
# redirect http to https
4
#<VirtualHost *:80> #nohttps
5
#  RewriteEngine On #nohttps
6
#  RewriteCond %{HTTPS} !=on #nohttps
7
#  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] #nohttps
8
#</VirtualHost> #nohttps
9
10
# OPAC
11
<VirtualHost *:80> #https
12
#  SSLEngine on
13
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
14
#  SSLCompression off
15
#  SSLHonorCipherOrder on
16
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-
17
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
18
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
19
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
20
21
  <IfVersion >= 2.4>
22
   Define instance "__KOHASITE__"
23
  </IfVersion>
24
   Include /etc/koha/apache-shared.conf
25
#  Include /etc/koha/apache-shared-disable.conf
26
#  Include /etc/koha/apache-shared-opac-plack.conf
27
   Include /etc/koha/apache-shared-opac.conf
28
29
   ServerName __OPACSERVER__
30
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
31
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
32
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
33
   AssignUserID __UNIXUSER__ __UNIXGROUP__
34
35
   ErrorLog    /var/log/koha/__KOHASITE__/opac-error.log
36
#  TransferLog /var/log/koha/__KOHASITE__/opac-access.log
37
#  RewriteLog  /var/log/koha/__KOHASITE__/opac-rewrite.log
38
</VirtualHost>
39
40
# Intranet
41
<VirtualHost *:80> #https
42
#  SSLEngine on
43
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
44
#  SSLCompression off
45
#  SSLHonorCipherOrder on
46
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES
47
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
48
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
49
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
50
51
  <IfVersion >= 2.4>
52
   Define instance "__KOHASITE__"
53
  </IfVersion>
54
   Include /etc/koha/apache-shared.conf
55
#  Include /etc/koha/apache-shared-disable.conf
56
#  Include /etc/koha/apache-shared-intranet-plack.conf
57
   Include /etc/koha/apache-shared-intranet.conf
58
59
   ServerName __INTRASERVER__
60
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
61
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
62
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
63
   AssignUserID __UNIXUSER__ __UNIXGROUP__
64
65
   ErrorLog    /var/log/koha/__KOHASITE__/intranet-error.log
66
#  TransferLog /var/log/koha/__KOHASITE__/intranet-access.log
67
#  RewriteLog  /var/log/koha/__KOHASITE__/intranet-rewrite.log
68
</VirtualHost>
(-)a/install_misc/debian.packages (-1 / +1 lines)
Lines 8-13 idzebra-2.0 install Link Here
8
idzebra-2.0-common	install
8
idzebra-2.0-common	install
9
idzebra-2.0-doc	install
9
idzebra-2.0-doc	install
10
idzebra-2.0-utils	install
10
idzebra-2.0-utils	install
11
letsencrypt install
11
libalgorithm-checkdigits-perl	install
12
libalgorithm-checkdigits-perl	install
12
libanyevent-http-perl		install
13
libanyevent-http-perl		install
13
libanyevent-perl		install
14
libanyevent-perl		install
14
- 

Return to bug 15303