View | Details | Raw Unified | Return to bug 15303
Collapse All | Expand All

(-)a/debian/control.in (-1 / +2 lines)
Lines 35-41 Depends: ${misc:Depends}, ${koha:Depends}, Link Here
35
 xmlstarlet,
35
 xmlstarlet,
36
 yaz
36
 yaz
37
Suggests: mysql-server | virtual-mysql-server,
37
Suggests: mysql-server | virtual-mysql-server,
38
 memcached
38
 memcached,
39
letsencrypt
39
Homepage: http://koha-community.org/
40
Homepage: http://koha-community.org/
40
Description: integrated (physical) library management system
41
Description: integrated (physical) library management system
41
 Koha is an Integrated Library Management system for real-world libraries
42
 Koha is an Integrated Library Management system for real-world libraries
(-)a/debian/docs/koha-create.xml (+8 lines)
Lines 40-45 Link Here
40
      <arg><option>--enable-sru</option></arg>
40
      <arg><option>--enable-sru</option></arg>
41
      <arg><option>--sru-port</option> port</arg>
41
      <arg><option>--sru-port</option> port</arg>
42
      <arg><option>--upload-path</option> directory</arg>
42
      <arg><option>--upload-path</option> directory</arg>
43
      <arg><option>--letsencrypt</option></arg>
43
      <arg><option>--help</option>|<option>-h</option></arg>
44
      <arg><option>--help</option>|<option>-h</option></arg>
44
45
45
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
46
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
Lines 177-182 Link Here
177
    </varlistentry>
178
    </varlistentry>
178
179
179
    <varlistentry>
180
    <varlistentry>
181
      <term><option>--letsencrypt</option></term>
182
      <listitem>
183
        <para>Set up a https-only website with letsencrypt certificates</para>
184
      </listitem>
185
    </varlistentry>
186
187
    <varlistentry>
180
      <term><option>--help</option>,<option>-h</option></term>
188
      <term><option>--help</option>,<option>-h</option></term>
181
      <listitem>
189
      <listitem>
182
        <para>Print usage information.</para>
190
        <para>Print usage information.</para>
(-)a/debian/scripts/koha-create (-3 / +72 lines)
Lines 71-76 Options: Link Here
71
                            conjunction with --defaultsql and --populate-db.
71
                            conjunction with --defaultsql and --populate-db.
72
  --upload-path dir         Set a user defined upload_path. It defaults to
72
  --upload-path dir         Set a user defined upload_path. It defaults to
73
                            /var/lib/koha/<instance>/uploads
73
                            /var/lib/koha/<instance>/uploads
74
  --letsencrypt             Set up a https-only site with letsencrypt certificates
74
  --help,-h                 Show this help.
75
  --help,-h                 Show this help.
75
76
76
Note: the instance name cannot be longer that 11 chars.
77
Note: the instance name cannot be longer that 11 chars.
Lines 192-197 EOM Link Here
192
        die
193
        die
193
    fi
194
    fi
194
195
196
    # Check that mod_ssl is installed and enabled.
197
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
198
        if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then
199
            cat 1>&2  <<EOM
200
201
Koha requires mod_ssl to be enabled within Apache in order to run with --letsencrypt.
202
Typically this can be enabled with:
203
204
    sudo a2enmod ssl
205
EOM
206
            die
207
        fi
208
    fi
209
195
}
210
}
196
211
197
set_biblios_indexing_mode()
212
set_biblios_indexing_mode()
Lines 311-316 enable_sru_server() Link Here
311
    fi
326
    fi
312
}
327
}
313
328
329
check_letsencrypt()
330
{
331
    if [ $(dpkg-query -W -f='${Status}' letsencrypt 2>/dev/null | grep -c "ok installed") -eq 0 ]; then
332
        apt-cache show letsencrypt &>/dev/null
333
        if [ $? -eq 0 ]; then
334
                read -r -p "The letsencrypt package is not installed. Do it now?  [y/N] " response
335
                if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then
336
                    apt-get install -y letsencrypt
337
                else
338
                    die "You have to install letsencrypt to use the --letsencrypt parameter."
339
                fi
340
        else
341
            echo "No installation candidate available for package letsencrypt."
342
            read -r -p "If you have a symlink from /usr/bin/letsencrypt to letsencrypt-auto, it should work. [y/N] " response
343
            if [[ ! $response =~ ^([yY][eE][sS]|[yY])$ ]]; then
344
                die "You have to install letsencrypt to use the --letsencrypt parameter."
345
            fi
346
        fi
347
    fi
348
}
349
350
letsencrypt_instance()
351
{
352
    # Get letsencrypt certificates
353
    letsencrypt --agree-tos --renew-by-default --webroot --staging certonly \
354
        -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain
355
    # enable all ssl settings (apache won't start with these before certs are present)
356
    sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf"
357
    # change port from 80 to 443. (apache won't start if it is 443 without certs present)
358
    sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf"
359
    # enable redirect from http to https on port 80
360
    sed -i "s:^\s*#\(.*\)#nohttps$:\1:" "/etc/apache2/sites-available/$name.conf"
361
    # make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead
362
    touch /var/lib/koha/$name/letsencrypt.enabled
363
    # restart apache with working certs
364
    service apache2 restart
365
}
366
314
# Set defaults and read config file, if it exists.
367
# Set defaults and read config file, if it exists.
315
DOMAIN=""
368
DOMAIN=""
316
OPACPORT="80"
369
OPACPORT="80"
Lines 354-359 END_BIBLIOS_RETRIEVAL_INFO="" Link Here
354
START_AUTHORITIES_RETRIEVAL_INFO=""
407
START_AUTHORITIES_RETRIEVAL_INFO=""
355
END_AUTHORITIES_RETRIEVAL_INFO=""
408
END_AUTHORITIES_RETRIEVAL_INFO=""
356
409
410
APACHE_CONFIGFILE=""
411
357
if [ -e /etc/koha/koha-sites.conf ]
412
if [ -e /etc/koha/koha-sites.conf ]
358
then
413
then
359
    . /etc/koha/koha-sites.conf
414
    . /etc/koha/koha-sites.conf
Lines 361-367 fi Link Here
361
416
362
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
417
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
363
418
364
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \
419
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt, \
365
     -n "$0" -- "$@"`
420
     -n "$0" -- "$@"`
366
421
367
# Note the quotes around `$TEMP': they are essential!
422
# Note the quotes around `$TEMP': they are essential!
Lines 377-383 CLO_AUTHORITIES_INDEXING_MODE="" Link Here
377
CLO_MEMCACHED_SERVERS=""
432
CLO_MEMCACHED_SERVERS=""
378
CLO_MEMCACHED_PREFIX=""
433
CLO_MEMCACHED_PREFIX=""
379
CLO_UPLOAD_PATH=""
434
CLO_UPLOAD_PATH=""
380
435
CLO_LETSENCRYPT=""
381
436
382
while true ; do
437
while true ; do
383
    case "$1" in
438
    case "$1" in
Lines 419-424 while true ; do Link Here
419
            SRU_SERVER_PORT="$2" ; shift 2 ;;
474
            SRU_SERVER_PORT="$2" ; shift 2 ;;
420
        --upload-path)
475
        --upload-path)
421
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
476
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
477
        --letsencrypt)
478
            CLO_LETSENCRYPT="yes" ; shift ;;
422
        -h|--help)
479
        -h|--help)
423
            usage ; exit 0 ;;
480
            usage ; exit 0 ;;
424
        --)
481
        --)
Lines 514-519 check_apache_config Link Here
514
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN"
571
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN"
515
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN"
572
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN"
516
573
574
# Check everything is ok with letsencrypt, die otherwise
575
check_letsencrypt
517
576
518
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ]
577
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ]
519
then
578
then
Lines 598-605 FLUSH PRIVILEGES; Link Here
598
eof
657
eof
599
    fi #`
658
    fi #`
600
659
660
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
661
        APACHE_CONFIGFILE="apache-site-https.conf.in"
662
    else
663
        APACHE_CONFIGFILE="apache-site.conf.in"
664
    fi
601
    # Generate and install Apache site-available file and log dir.
665
    # Generate and install Apache site-available file and log dir.
602
    generate_config_file apache-site.conf.in \
666
    generate_config_file $APACHE_CONFIGFILE \
603
        "/etc/apache2/sites-available/$name.conf"
667
        "/etc/apache2/sites-available/$name.conf"
604
    mkdir "/var/log/koha/$name"
668
    mkdir "/var/log/koha/$name"
605
    chown "$username:$username" "/var/log/koha/$name"
669
    chown "$username:$username" "/var/log/koha/$name"
Lines 708-713 then Link Here
708
        # Start Indexer daemon
772
        # Start Indexer daemon
709
        koha-indexer --start "$name"
773
        koha-indexer --start "$name"
710
    fi
774
    fi
775
776
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
777
        # Get letsencrypt certificates
778
        letsencrypt_instance
779
    fi
711
fi
780
fi
712
781
713
782
(-)a/debian/scripts/koha-foreach (+2 lines)
Lines 30-35 do Link Here
30
        --nosip) listopts="$listopts --nosip";;
30
        --nosip) listopts="$listopts --nosip";;
31
        --plack) listopts="$listopts --plack";;
31
        --plack) listopts="$listopts --plack";;
32
      --noplack) listopts="$listopts --noplack";;
32
      --noplack) listopts="$listopts --noplack";;
33
  --letsencrypt) listopts="$listopts --letsencrypt" ;;
34
--noletsencrypt) listopts="$listopts --noletsencrypt" ;;
33
              *) break;;
35
              *) break;;
34
    esac
36
    esac
35
    shift
37
    shift
(-)a/debian/scripts/koha-functions.sh (+11 lines)
Lines 84-89 is_email_enabled() Link Here
84
    fi
84
    fi
85
}
85
}
86
86
87
is_letsencrypt_enabled()
88
{
89
    local instancename=$1
90
91
    if [ -e /var/lib/koha/$instancename/letsencrypt.enabled ]; then
92
        return 0
93
    else
94
        return 1
95
    fi
96
}
97
87
is_sip_enabled()
98
is_sip_enabled()
88
{
99
{
89
    local instancename=$1
100
    local instancename=$1
(-)a/debian/scripts/koha-list (-20 / +61 lines)
Lines 36-59 show_instances() Link Here
36
    for instance in $( get_instances ); do
36
    for instance in $( get_instances ); do
37
        case $show in
37
        case $show in
38
          "all")
38
          "all")
39
              if instance_filter_email $instance $show_email && \
39
              if instance_filter_email       $instance $show_email && \
40
                 instance_filter_plack $instance $show_plack && \
40
                 instance_filter_letsencrypt $instance $show_letsencrypt && \
41
                 instance_filter_sip   $instance $show_sip; then
41
                 instance_filter_plack       $instance $show_plack && \
42
                 instance_filter_sip         $instance $show_sip; then
42
                    echo $instance
43
                    echo $instance
43
              fi ;;
44
              fi ;;
44
          "enabled")
45
          "enabled")
45
              if is_enabled $instance; then
46
              if is_enabled $instance; then
46
                  if instance_filter_email $instance $show_email && \
47
                  if instance_filter_email       $instance $show_email && \
47
                     instance_filter_plack $instance $show_plack && \
48
                     instance_filter_letsencrypt $instance $show_letsencrypt && \
48
                     instance_filter_sip   $instance $show_sip; then
49
                     instance_filter_plack       $instance $show_plack && \
50
                     instance_filter_sip         $instance $show_sip; then
49
                      echo $instance
51
                      echo $instance
50
                  fi
52
                  fi
51
              fi ;;
53
              fi ;;
52
          "disabled")
54
          "disabled")
53
              if ! is_enabled $instance; then
55
              if ! is_enabled $instance; then
54
                  if instance_filter_email $instance $show_email && \
56
                  if instance_filter_email       $instance $show_email && \
55
                     instance_filter_plack $instance $show_plack && \
57
                     instance_filter_letsencrypt $instance $show_letsencrypt && \
56
                     instance_filter_sip   $instance $show_sip; then
58
                     instance_filter_plack       $instance $show_plack && \
59
                     instance_filter_sip         $instance $show_sip; then
57
                      echo $instance
60
                      echo $instance
58
                  fi
61
                  fi
59
              fi ;;
62
              fi ;;
Lines 106-111 instance_filter_plack() Link Here
106
    return 1
109
    return 1
107
}
110
}
108
111
112
instance_filter_letsencrypt()
113
{
114
    local instancename=$1
115
    local show_letsencrypt=$2;
116
117
    case $show_letsencrypt in
118
        "all")
119
            return 0 ;;
120
        "enabled")
121
            if is_letsencrypt_enabled $instancename; then
122
                return 0
123
            fi ;;
124
        "disabled")
125
            if ! is_letsencrypt_enabled $instancename; then
126
                return 0
127
            fi ;;
128
    esac
129
130
    # Didn't match any criteria
131
    return 1
132
}
133
109
instance_filter_email()
134
instance_filter_email()
110
{
135
{
111
    local instancename=$1
136
    local instancename=$1
Lines 150-155 set_show_email() Link Here
150
    fi
175
    fi
151
}
176
}
152
177
178
set_show_letsencrypt()
179
{
180
    local letsencrypt_param=$1
181
182
    if [ "$show_letsencrypt" = "all" ]; then
183
        show_letsencrypt=$letsencrypt_param
184
    else
185
        die "Error: --letsencrypt and --noletsencrypt are mutually exclusive."
186
    fi
187
}
188
153
set_show_plack()
189
set_show_plack()
154
{
190
{
155
    local plack_param=$1
191
    local plack_param=$1
Lines 190-195 Options: Link Here
190
    --nosip         Show instances with SIP disabled
226
    --nosip         Show instances with SIP disabled
191
    --plack         Show instances with Plack enabled
227
    --plack         Show instances with Plack enabled
192
    --noplack       Show instances with Plack disabled
228
    --noplack       Show instances with Plack disabled
229
    --letsencrypt   Show instances with letsencrypt enabled
230
    --noletsencrypt Show instances with letsencrypt disabled
193
    --help | -h     Show this help
231
    --help | -h     Show this help
194
232
195
The filtering options can be combined, and you probably want to do this
233
The filtering options can be combined, and you probably want to do this
Lines 201-223 show="all" Link Here
201
show_email="all"
239
show_email="all"
202
show_sip="all"
240
show_sip="all"
203
show_plack="all"
241
show_plack="all"
242
show_letsencrypt="all"
204
243
205
args=$(getopt -l help,enabled,disabled,email,noemail,sip,nosip,plack,noplack -o h -n $0 -- "$@")
244
args=$(getopt -l help,enabled,disabled,email,noemail,sip,nosip,plack,noplack,letsencrypt,noletsencrypt -o h -n $0 -- "$@")
206
set -- $args
245
set -- $args
207
246
208
while [ ! -z "$1" ]
247
while [ ! -z "$1" ]
209
do
248
do
210
    case "$1" in
249
    case "$1" in
211
  -h|--help) usage; exit;;
250
      -h|--help) usage; exit;;
212
    --email) set_show_email "enabled" ;;
251
        --email) set_show_email "enabled" ;;
213
  --noemail) set_show_email "disabled" ;;
252
      --noemail) set_show_email "disabled" ;;
214
      --sip) set_show_sip "enabled" ;;
253
          --sip) set_show_sip "enabled" ;;
215
    --nosip) set_show_sip "disabled" ;;
254
        --nosip) set_show_sip "disabled" ;;
216
    --plack) set_show_plack "enabled" ;;
255
        --plack) set_show_plack "enabled" ;;
217
  --noplack) set_show_plack "disabled" ;;
256
      --noplack) set_show_plack "disabled" ;;
218
  --enabled) set_show "enabled" ;;
257
  --letsencrypt) set_show_letsencrypt "enabled" ;;
219
 --disabled) set_show "disabled" ;;
258
--noletsencrypt) set_show_letsencrypt "disabled" ;;
220
          *) break;;
259
      --enabled) set_show "enabled" ;;
260
     --disabled) set_show "disabled" ;;
261
              *) break;;
221
    esac
262
    esac
222
    shift
263
    shift
223
done
264
done
(-)a/debian/templates/apache-site-https.conf.in (+70 lines)
Line 0 Link Here
1
# Koha instance __KOHASITE__ Apache config.
2
3
# redirect http to https
4
#<VirtualHost *:80> #nohttps
5
#   ServerName __OPACSERVER__ #nohttps
6
#   ServerAlias __INTRASERVER__ #nohttps
7
#   RewriteEngine On #nohttps
8
#   RewriteCond %{HTTPS} !=on #nohttps
9
#   RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] #nohttps
10
#</VirtualHost> #nohttps
11
12
# OPAC
13
<VirtualHost *:80> #https
14
#  SSLEngine on
15
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
16
#  SSLCompression off
17
#  SSLHonorCipherOrder on
18
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-
19
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
20
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
21
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
22
23
  <IfVersion >= 2.4>
24
   Define instance "__KOHASITE__"
25
  </IfVersion>
26
   Include /etc/koha/apache-shared.conf
27
#  Include /etc/koha/apache-shared-disable.conf
28
#  Include /etc/koha/apache-shared-opac-plack.conf
29
   Include /etc/koha/apache-shared-opac.conf
30
31
   ServerName __OPACSERVER__
32
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
33
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
34
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
35
   AssignUserID __UNIXUSER__ __UNIXGROUP__
36
37
   ErrorLog    /var/log/koha/__KOHASITE__/opac-error.log
38
#  TransferLog /var/log/koha/__KOHASITE__/opac-access.log
39
#  RewriteLog  /var/log/koha/__KOHASITE__/opac-rewrite.log
40
</VirtualHost>
41
42
# Intranet
43
<VirtualHost *:80> #https
44
#  SSLEngine on
45
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
46
#  SSLCompression off
47
#  SSLHonorCipherOrder on
48
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES
49
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
50
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
51
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
52
53
  <IfVersion >= 2.4>
54
   Define instance "__KOHASITE__"
55
  </IfVersion>
56
   Include /etc/koha/apache-shared.conf
57
#  Include /etc/koha/apache-shared-disable.conf
58
#  Include /etc/koha/apache-shared-intranet-plack.conf
59
   Include /etc/koha/apache-shared-intranet.conf
60
61
   ServerName __INTRASERVER__
62
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
63
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
64
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
65
   AssignUserID __UNIXUSER__ __UNIXGROUP__
66
67
   ErrorLog    /var/log/koha/__KOHASITE__/intranet-error.log
68
#  TransferLog /var/log/koha/__KOHASITE__/intranet-access.log
69
#  RewriteLog  /var/log/koha/__KOHASITE__/intranet-rewrite.log
70
</VirtualHost>
(-)a/install_misc/debian.packages (-1 / +1 lines)
Lines 8-13 idzebra-2.0 install Link Here
8
idzebra-2.0-common	install
8
idzebra-2.0-common	install
9
idzebra-2.0-doc	install
9
idzebra-2.0-doc	install
10
idzebra-2.0-utils	install
10
idzebra-2.0-utils	install
11
letsencrypt install
11
libalgorithm-checkdigits-perl	install
12
libalgorithm-checkdigits-perl	install
12
libanyevent-http-perl		install
13
libanyevent-http-perl		install
13
libanyevent-perl		install
14
libanyevent-perl		install
14
- 

Return to bug 15303