View | Details | Raw Unified | Return to bug 15303
Collapse All | Expand All

(-)a/debian/control.in (-1 / +2 lines)
Lines 35-41 Depends: ${misc:Depends}, ${koha:Depends}, Link Here
35
 xmlstarlet,
35
 xmlstarlet,
36
 yaz
36
 yaz
37
Suggests: mysql-server | virtual-mysql-server,
37
Suggests: mysql-server | virtual-mysql-server,
38
 memcached
38
 memcached,
39
letsencrypt
39
Homepage: http://koha-community.org/
40
Homepage: http://koha-community.org/
40
Description: integrated (physical) library management system
41
Description: integrated (physical) library management system
41
 Koha is an Integrated Library Management system for real-world libraries
42
 Koha is an Integrated Library Management system for real-world libraries
(-)a/debian/docs/koha-create.xml (+8 lines)
Lines 40-45 Link Here
40
      <arg><option>--enable-sru</option></arg>
40
      <arg><option>--enable-sru</option></arg>
41
      <arg><option>--sru-port</option> port</arg>
41
      <arg><option>--sru-port</option> port</arg>
42
      <arg><option>--upload-path</option> directory</arg>
42
      <arg><option>--upload-path</option> directory</arg>
43
      <arg><option>--letsencrypt</option></arg>
43
      <arg><option>--help</option>|<option>-h</option></arg>
44
      <arg><option>--help</option>|<option>-h</option></arg>
44
45
45
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
46
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
Lines 177-182 Link Here
177
    </varlistentry>
178
    </varlistentry>
178
179
179
    <varlistentry>
180
    <varlistentry>
181
      <term><option>--letsencrypt</option></term>
182
      <listitem>
183
        <para>Set up a https-only website with letsencrypt certificates</para>
184
      </listitem>
185
    </varlistentry>
186
187
    <varlistentry>
180
      <term><option>--help</option>,<option>-h</option></term>
188
      <term><option>--help</option>,<option>-h</option></term>
181
      <listitem>
189
      <listitem>
182
        <para>Print usage information.</para>
190
        <para>Print usage information.</para>
(-)a/debian/scripts/koha-create (-3 / +72 lines)
Lines 71-76 Options: Link Here
71
                            conjunction with --defaultsql and --populate-db.
71
                            conjunction with --defaultsql and --populate-db.
72
  --upload-path dir         Set a user defined upload_path. It defaults to
72
  --upload-path dir         Set a user defined upload_path. It defaults to
73
                            /var/lib/koha/<instance>/uploads
73
                            /var/lib/koha/<instance>/uploads
74
  --letsencrypt             Set up a https-only site with letsencrypt certificates
74
  --help,-h                 Show this help.
75
  --help,-h                 Show this help.
75
76
76
Note: the instance name cannot be longer that 11 chars.
77
Note: the instance name cannot be longer that 11 chars.
Lines 194-199 EOM Link Here
194
        die
195
        die
195
    fi
196
    fi
196
197
198
    # Check that mod_ssl is installed and enabled.
199
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
200
        if ! /usr/sbin/apachectl -M 2> /dev/null | grep -q 'ssl_module'; then
201
            cat 1>&2  <<EOM
202
203
Koha requires mod_ssl to be enabled within Apache in order to run with --letsencrypt.
204
Typically this can be enabled with:
205
206
    sudo a2enmod ssl
207
EOM
208
            die
209
        fi
210
    fi
211
197
}
212
}
198
213
199
set_biblios_indexing_mode()
214
set_biblios_indexing_mode()
Lines 313-318 enable_sru_server() Link Here
313
    fi
328
    fi
314
}
329
}
315
330
331
check_letsencrypt()
332
{
333
    if [ $(dpkg-query -W -f='${Status}' letsencrypt 2>/dev/null | grep -c "ok installed") -eq 0 ]; then
334
        apt-cache show letsencrypt &>/dev/null
335
        if [ $? -eq 0 ]; then
336
                read -r -p "The letsencrypt package is not installed. Do it now?  [y/N] " response
337
                if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then
338
                    apt-get install -y letsencrypt
339
                else
340
                    die "You have to install letsencrypt to use the --letsencrypt parameter."
341
                fi
342
        else
343
            echo "No installation candidate available for package letsencrypt."
344
            read -r -p "If you have a symlink from /usr/bin/letsencrypt to letsencrypt-auto, it should work. [y/N] " response
345
            if [[ ! $response =~ ^([yY][eE][sS]|[yY])$ ]]; then
346
                die "You have to install letsencrypt to use the --letsencrypt parameter."
347
            fi
348
        fi
349
    fi
350
}
351
352
letsencrypt_instance()
353
{
354
    # Get letsencrypt certificates
355
    letsencrypt --agree-tos --renew-by-default --webroot --staging certonly \
356
        -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain
357
    # enable all ssl settings (apache won't start with these before certs are present)
358
    sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf"
359
    # change port from 80 to 443. (apache won't start if it is 443 without certs present)
360
    sed -i "s:^\s*\(<VirtualHost \*\:\)80> #https$:\1443>:" "/etc/apache2/sites-available/$name.conf"
361
    # enable redirect from http to https on port 80
362
    sed -i "s:^\s*#\(.*\)#nohttps$:\1:" "/etc/apache2/sites-available/$name.conf"
363
    # make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead
364
    touch /var/lib/koha/$name/letsencrypt.enabled
365
    # restart apache with working certs
366
    service apache2 restart
367
}
368
316
# Set defaults and read config file, if it exists.
369
# Set defaults and read config file, if it exists.
317
DOMAIN=""
370
DOMAIN=""
318
OPACPORT="80"
371
OPACPORT="80"
Lines 356-361 END_BIBLIOS_RETRIEVAL_INFO="" Link Here
356
START_AUTHORITIES_RETRIEVAL_INFO=""
409
START_AUTHORITIES_RETRIEVAL_INFO=""
357
END_AUTHORITIES_RETRIEVAL_INFO=""
410
END_AUTHORITIES_RETRIEVAL_INFO=""
358
411
412
APACHE_CONFIGFILE=""
413
359
if [ -e /etc/koha/koha-sites.conf ]
414
if [ -e /etc/koha/koha-sites.conf ]
360
then
415
then
361
    . /etc/koha/koha-sites.conf
416
    . /etc/koha/koha-sites.conf
Lines 363-369 fi Link Here
363
418
364
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
419
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
365
420
366
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \
421
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt, \
367
     -n "$0" -- "$@"`
422
     -n "$0" -- "$@"`
368
423
369
# Note the quotes around `$TEMP': they are essential!
424
# Note the quotes around `$TEMP': they are essential!
Lines 379-385 CLO_AUTHORITIES_INDEXING_MODE="" Link Here
379
CLO_MEMCACHED_SERVERS=""
434
CLO_MEMCACHED_SERVERS=""
380
CLO_MEMCACHED_PREFIX=""
435
CLO_MEMCACHED_PREFIX=""
381
CLO_UPLOAD_PATH=""
436
CLO_UPLOAD_PATH=""
382
437
CLO_LETSENCRYPT=""
383
438
384
while true ; do
439
while true ; do
385
    case "$1" in
440
    case "$1" in
Lines 421-426 while true ; do Link Here
421
            SRU_SERVER_PORT="$2" ; shift 2 ;;
476
            SRU_SERVER_PORT="$2" ; shift 2 ;;
422
        --upload-path)
477
        --upload-path)
423
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
478
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
479
        --letsencrypt)
480
            CLO_LETSENCRYPT="yes" ; shift ;;
424
        -h|--help)
481
        -h|--help)
425
            usage ; exit 0 ;;
482
            usage ; exit 0 ;;
426
        --)
483
        --)
Lines 516-521 check_apache_config Link Here
516
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN"
573
opacdomain="$OPACPREFIX$name$OPACSUFFIX$DOMAIN"
517
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN"
574
intradomain="$INTRAPREFIX$name$INTRASUFFIX$DOMAIN"
518
575
576
# Check everything is ok with letsencrypt, die otherwise
577
check_letsencrypt
519
578
520
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ]
579
if [ -f $PASSWDFILE ] && [ `cat $PASSWDFILE | grep "^$name:"` ]
521
then
580
then
Lines 600-607 FLUSH PRIVILEGES; Link Here
600
eof
659
eof
601
    fi #`
660
    fi #`
602
661
662
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
663
        APACHE_CONFIGFILE="apache-site-https.conf.in"
664
    else
665
        APACHE_CONFIGFILE="apache-site.conf.in"
666
    fi
603
    # Generate and install Apache site-available file and log dir.
667
    # Generate and install Apache site-available file and log dir.
604
    generate_config_file apache-site.conf.in \
668
    generate_config_file $APACHE_CONFIGFILE \
605
        "/etc/apache2/sites-available/$name.conf"
669
        "/etc/apache2/sites-available/$name.conf"
606
    mkdir "/var/log/koha/$name"
670
    mkdir "/var/log/koha/$name"
607
    chown "$username:$username" "/var/log/koha/$name"
671
    chown "$username:$username" "/var/log/koha/$name"
Lines 710-715 then Link Here
710
        # Start Indexer daemon
774
        # Start Indexer daemon
711
        koha-indexer --start "$name"
775
        koha-indexer --start "$name"
712
    fi
776
    fi
777
778
    if [ "$CLO_LETSENCRYPT" = "yes" ]; then
779
        # Get letsencrypt certificates
780
        letsencrypt_instance
781
    fi
713
fi
782
fi
714
783
715
784
(-)a/debian/scripts/koha-foreach (+2 lines)
Lines 30-35 do Link Here
30
        --nosip) listopts="$listopts --nosip";;
30
        --nosip) listopts="$listopts --nosip";;
31
        --plack) listopts="$listopts --plack";;
31
        --plack) listopts="$listopts --plack";;
32
      --noplack) listopts="$listopts --noplack";;
32
      --noplack) listopts="$listopts --noplack";;
33
  --letsencrypt) listopts="$listopts --letsencrypt" ;;
34
--noletsencrypt) listopts="$listopts --noletsencrypt" ;;
33
              *) break;;
35
              *) break;;
34
    esac
36
    esac
35
    shift
37
    shift
(-)a/debian/scripts/koha-functions.sh (+11 lines)
Lines 84-89 is_email_enabled() Link Here
84
    fi
84
    fi
85
}
85
}
86
86
87
is_letsencrypt_enabled()
88
{
89
    local instancename=$1
90
91
    if [ -e /var/lib/koha/$instancename/letsencrypt.enabled ]; then
92
        return 0
93
    else
94
        return 1
95
    fi
96
}
97
87
is_sip_enabled()
98
is_sip_enabled()
88
{
99
{
89
    local instancename=$1
100
    local instancename=$1
(-)a/debian/scripts/koha-list (-20 / +61 lines)
Lines 36-59 show_instances() Link Here
36
    for instance in $( get_instances ); do
36
    for instance in $( get_instances ); do
37
        case $show in
37
        case $show in
38
          "all")
38
          "all")
39
              if instance_filter_email $instance $show_email && \
39
              if instance_filter_email       $instance $show_email && \
40
                 instance_filter_plack $instance $show_plack && \
40
                 instance_filter_letsencrypt $instance $show_letsencrypt && \
41
                 instance_filter_sip   $instance $show_sip; then
41
                 instance_filter_plack       $instance $show_plack && \
42
                 instance_filter_sip         $instance $show_sip; then
42
                    echo $instance
43
                    echo $instance
43
              fi ;;
44
              fi ;;
44
          "enabled")
45
          "enabled")
45
              if is_enabled $instance; then
46
              if is_enabled $instance; then
46
                  if instance_filter_email $instance $show_email && \
47
                  if instance_filter_email       $instance $show_email && \
47
                     instance_filter_plack $instance $show_plack && \
48
                     instance_filter_letsencrypt $instance $show_letsencrypt && \
48
                     instance_filter_sip   $instance $show_sip; then
49
                     instance_filter_plack       $instance $show_plack && \
50
                     instance_filter_sip         $instance $show_sip; then
49
                      echo $instance
51
                      echo $instance
50
                  fi
52
                  fi
51
              fi ;;
53
              fi ;;
52
          "disabled")
54
          "disabled")
53
              if ! is_enabled $instance; then
55
              if ! is_enabled $instance; then
54
                  if instance_filter_email $instance $show_email && \
56
                  if instance_filter_email       $instance $show_email && \
55
                     instance_filter_plack $instance $show_plack && \
57
                     instance_filter_letsencrypt $instance $show_letsencrypt && \
56
                     instance_filter_sip   $instance $show_sip; then
58
                     instance_filter_plack       $instance $show_plack && \
59
                     instance_filter_sip         $instance $show_sip; then
57
                      echo $instance
60
                      echo $instance
58
                  fi
61
                  fi
59
              fi ;;
62
              fi ;;
Lines 106-111 instance_filter_plack() Link Here
106
    return 1
109
    return 1
107
}
110
}
108
111
112
instance_filter_letsencrypt()
113
{
114
    local instancename=$1
115
    local show_letsencrypt=$2;
116
117
    case $show_letsencrypt in
118
        "all")
119
            return 0 ;;
120
        "enabled")
121
            if is_letsencrypt_enabled $instancename; then
122
                return 0
123
            fi ;;
124
        "disabled")
125
            if ! is_letsencrypt_enabled $instancename; then
126
                return 0
127
            fi ;;
128
    esac
129
130
    # Didn't match any criteria
131
    return 1
132
}
133
109
instance_filter_email()
134
instance_filter_email()
110
{
135
{
111
    local instancename=$1
136
    local instancename=$1
Lines 150-155 set_show_email() Link Here
150
    fi
175
    fi
151
}
176
}
152
177
178
set_show_letsencrypt()
179
{
180
    local letsencrypt_param=$1
181
182
    if [ "$show_letsencrypt" = "all" ]; then
183
        show_letsencrypt=$letsencrypt_param
184
    else
185
        die "Error: --letsencrypt and --noletsencrypt are mutually exclusive."
186
    fi
187
}
188
153
set_show_plack()
189
set_show_plack()
154
{
190
{
155
    local plack_param=$1
191
    local plack_param=$1
Lines 190-195 Options: Link Here
190
    --nosip         Show instances with SIP disabled
226
    --nosip         Show instances with SIP disabled
191
    --plack         Show instances with Plack enabled
227
    --plack         Show instances with Plack enabled
192
    --noplack       Show instances with Plack disabled
228
    --noplack       Show instances with Plack disabled
229
    --letsencrypt   Show instances with letsencrypt enabled
230
    --noletsencrypt Show instances with letsencrypt disabled
193
    --help | -h     Show this help
231
    --help | -h     Show this help
194
232
195
The filtering options can be combined, and you probably want to do this
233
The filtering options can be combined, and you probably want to do this
Lines 201-223 show="all" Link Here
201
show_email="all"
239
show_email="all"
202
show_sip="all"
240
show_sip="all"
203
show_plack="all"
241
show_plack="all"
242
show_letsencrypt="all"
204
243
205
args=$(getopt -l help,enabled,disabled,email,noemail,sip,nosip,plack,noplack -o h -n $0 -- "$@")
244
args=$(getopt -l help,enabled,disabled,email,noemail,sip,nosip,plack,noplack,letsencrypt,noletsencrypt -o h -n $0 -- "$@")
206
set -- $args
245
set -- $args
207
246
208
while [ ! -z "$1" ]
247
while [ ! -z "$1" ]
209
do
248
do
210
    case "$1" in
249
    case "$1" in
211
  -h|--help) usage; exit;;
250
      -h|--help) usage; exit;;
212
    --email) set_show_email "enabled" ;;
251
        --email) set_show_email "enabled" ;;
213
  --noemail) set_show_email "disabled" ;;
252
      --noemail) set_show_email "disabled" ;;
214
      --sip) set_show_sip "enabled" ;;
253
          --sip) set_show_sip "enabled" ;;
215
    --nosip) set_show_sip "disabled" ;;
254
        --nosip) set_show_sip "disabled" ;;
216
    --plack) set_show_plack "enabled" ;;
255
        --plack) set_show_plack "enabled" ;;
217
  --noplack) set_show_plack "disabled" ;;
256
      --noplack) set_show_plack "disabled" ;;
218
  --enabled) set_show "enabled" ;;
257
  --letsencrypt) set_show_letsencrypt "enabled" ;;
219
 --disabled) set_show "disabled" ;;
258
--noletsencrypt) set_show_letsencrypt "disabled" ;;
220
          *) break;;
259
      --enabled) set_show "enabled" ;;
260
     --disabled) set_show "disabled" ;;
261
              *) break;;
221
    esac
262
    esac
222
    shift
263
    shift
223
done
264
done
(-)a/debian/templates/apache-site-https.conf.in (+70 lines)
Line 0 Link Here
1
# Koha instance __KOHASITE__ Apache config.
2
3
# redirect http to https
4
#<VirtualHost *:80> #nohttps
5
#   ServerName __OPACSERVER__ #nohttps
6
#   ServerAlias __INTRASERVER__ #nohttps
7
#   RewriteEngine On #nohttps
8
#   RewriteCond %{HTTPS} !=on #nohttps
9
#   RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] #nohttps
10
#</VirtualHost> #nohttps
11
12
# OPAC
13
<VirtualHost *:80> #https
14
#  SSLEngine on
15
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
16
#  SSLCompression off
17
#  SSLHonorCipherOrder on
18
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-
19
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
20
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
21
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
22
23
  <IfVersion >= 2.4>
24
   Define instance "__KOHASITE__"
25
  </IfVersion>
26
   Include /etc/koha/apache-shared.conf
27
#  Include /etc/koha/apache-shared-disable.conf
28
#  Include /etc/koha/apache-shared-opac-plack.conf
29
   Include /etc/koha/apache-shared-opac.conf
30
31
   ServerName __OPACSERVER__
32
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
33
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
34
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
35
   AssignUserID __UNIXUSER__ __UNIXGROUP__
36
37
   ErrorLog    /var/log/koha/__KOHASITE__/opac-error.log
38
#  TransferLog /var/log/koha/__KOHASITE__/opac-access.log
39
#  RewriteLog  /var/log/koha/__KOHASITE__/opac-rewrite.log
40
</VirtualHost>
41
42
# Intranet
43
<VirtualHost *:80> #https
44
#  SSLEngine on
45
#  SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
46
#  SSLCompression off
47
#  SSLHonorCipherOrder on
48
#  SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES
49
#  SSLCertificateKeyFile   /etc/letsencrypt/live/__OPACSERVER__/privkey.pem
50
#  SSLCertificateFile      /etc/letsencrypt/live/__OPACSERVER__/cert.pem
51
#  SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem
52
53
  <IfVersion >= 2.4>
54
   Define instance "__KOHASITE__"
55
  </IfVersion>
56
   Include /etc/koha/apache-shared.conf
57
#  Include /etc/koha/apache-shared-disable.conf
58
#  Include /etc/koha/apache-shared-intranet-plack.conf
59
   Include /etc/koha/apache-shared-intranet.conf
60
61
   ServerName __INTRASERVER__
62
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
63
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
64
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
65
   AssignUserID __UNIXUSER__ __UNIXGROUP__
66
67
   ErrorLog    /var/log/koha/__KOHASITE__/intranet-error.log
68
#  TransferLog /var/log/koha/__KOHASITE__/intranet-access.log
69
#  RewriteLog  /var/log/koha/__KOHASITE__/intranet-rewrite.log
70
</VirtualHost>
(-)a/install_misc/debian.packages (-1 / +1 lines)
Lines 8-13 idzebra-2.0 install Link Here
8
idzebra-2.0-common	install
8
idzebra-2.0-common	install
9
idzebra-2.0-doc	install
9
idzebra-2.0-doc	install
10
idzebra-2.0-utils	install
10
idzebra-2.0-utils	install
11
letsencrypt install
11
libalgorithm-checkdigits-perl	install
12
libalgorithm-checkdigits-perl	install
12
libanyevent-http-perl		install
13
libanyevent-http-perl		install
13
libanyevent-perl		install
14
libanyevent-perl		install
14
- 

Return to bug 15303